Shodan Internet Scan Database Query

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.