Passive recon
All data comes from Shodan's own index — we never scan or probe your systems, so there's zero risk to production.
Data source · Attack surface
Shodan.
Correlated. One report.
Shodan continuously scans the public internet and indexes every reachable service, giving a map of your external footprint from the attacker's point of view.
About the source
What is Shodan?
darkweb-scanner uses Shodan's DNS and InternetDB data to enumerate a domain's subdomains, resolve its internet-facing hosts, and report open ports, exposed services, and known CVEs — without sending a single packet to your infrastructure. Exposed databases, admin panels, and legacy services are surfaced as attack-surface findings.
- Maintainer
- Shodan
- Coverage
- Subdomains, ports, services, CVEs
- License
- Shodan API
- Source
- shodan.io ↗
Capabilities
What Shodan covers
The source's scope — we query it against your domain and report the exposures we find.
Subdomain mapping
Discovers forgotten and staging hosts that expand your attack surface.
Risky-service detection
Flags internet-facing RDP, databases, and admin panels that shouldn't be public.
CVE correlation
Surfaces known vulnerabilities indexed against your internet-facing hosts.
Surface area
Where it looks
SubdomainsOpen portsExposed servicesKnown CVEs
Use cases
When it earns its keep
Attack-surface review
Get an outside-in view of everything your domain exposes to the internet.
Shadow IT discovery
Find subdomains and services nobody remembered were still online.
Pre-engagement recon
Scope an assessment with a map of a domain's external footprint.
Other data sources
Add another source
Cavalier
Infostealer / stealer-log intelligence — which employees and users of a domain have been captured by malware, including live credential and session data.
theHarvester
Open-source OSINT collection — emails, subdomains, and hosts gathered from dozens of keyless public sources, plus the Hudson Rock breach module.
Maigret
Maps usernames and handles tied to a domain's people across 4,000+ sites — the public identity footprint attackers use for targeting.
One credit. One domain. One report.
Run Shodan against a domain and get a severity-ranked exposure PDF. Credits never expire.