Security tip 1 · Shodan Monitor
Get an email when a new port opens.
Shodan Monitor watches your public IP addresses and domains and writes to you when something changes. Setup takes about 20 minutes and costs about the same as a good bottle of gin.
Last checked 1 November 2026
- Time
- ~20 min
- Price
- 49 USD once
- Watches
- 16 IPs or domains
- Needs
- A static public IP
Why
Most break-ins come through a door that was left open.
Many attacks do not start with anything advanced, but with a port nobody remembered: a firewall rule from a test that was never removed, a router that went online with its default setup, or a service nobody uses any more.
Attackers scan the whole internet all the time. Shodan does the same – but lets you see the results for your own addresses, and tells you before someone else takes advantage.
- Shodan scansthe whole internet
- Your addressesone port is open
- Monitor comparesnew since last time?
- Email to youyou close the port
What is Shodan Monitor?
A monitoring service from Shodan.io, the search engine for everything connected to the internet. You tell Monitor which IP addresses and domains are yours, and it emails you when it finds open ports, new services or known vulnerabilities on them.
Before you start
Five things to have ready.
- Your public IP addresses. They are in your router or with your internet provider. If you have a website, you can use the domain instead.
- A static IP address. Businesses usually have one already. Most internet providers offer a static IP for a small monthly fee. With a changing IP you can use services such as No-IP or DynDNS, but this guide does not cover that.
- Only your own addresses. Only monitor IP addresses and domains you own or have permission to monitor.
- An email address for alerts – ideally one several people read, such as it@ in a small business.
- 49 USD for a Shodan Membership. It is a one-time payment for lifetime access and includes Monitor for 16 IP addresses or domains. Shodan has previously cut the price sharply around Black Friday – if you are not in a hurry, look out for it in late November.
Step by step
Seven steps, about 20 minutes.
Create an account and buy the Membership
Go to account.shodan.io/register. Choose a username, password and email, and press Create. Confirm your email with the link you receive. Then buy Membership under Billing.
Open Monitor
Log in and press Setup Network Monitoring under Quick links on your dashboard – or go straight to monitor.shodan.io.
Set up email alerts first
Click Settings in Monitor’s top menu. Under Notification Services, choose Email and press Add for each address that should be notified. Do this before the next step, so you can tick them when you add your addresses. You can always change them later.
Go to Manage Assets
Click Manage Assets. Here you choose Add Network to monitor an IP address or range, or Add Domain to monitor a domain, such as your company website.
Add an IP address
With Add Network, give the monitor a name you will recognise (e.g.
Office – fibre) and enter the IP address or range in CIDR form (e.g.203.0.113.0/29). Tick your email under Notification Services and press Add Network.…or add a domain
With Add Domain, just enter the domain. Monitor finds the subdomains and IP addresses that belong to it from DNS – and keeps up when DNS changes. Tick your email and press Add Domain.
Done – check the receipt
You land back on Manage Assets with a green confirmation. The default setup covers what matters, so you do not need to do more. To look closer: the eye shows the results, the gear changes what triggers an alert, and the bin stops the monitoring.
When the email arrives
What the alert means.
new_service- A new port or service is visible from the internet. This is exactly what this tip is about.
vulnerable- The service answers with a software version that has known vulnerabilities (CVEs).
end_of_life- The software is no longer updated by its vendor.
ssl_expired- A certificate has expired.
open_database- A database answers from outside – often without a login.
iot · industrial_control_system- Cameras, printers, controllers and similar devices are visible from the internet.
malware · internet_scanner- The address behaves like a known malware server or is scanning the internet itself. That can mean a machine on your side is compromised.
And what you do
Four questions.
Should it be open?
If not: close the port in the firewall or router. It is the fastest and best fix.
It should, but not for everyone?
Limit access to known IP addresses, or put the service behind a VPN.
Is the software vulnerable?
Update it. If it cannot be updated, take it off the internet.
Can nobody explain it?
Then treat it as an incident. Also check whether the router has UPnP switched on – it lets devices on the network open ports by themselves. Turn it off if you do not use it.
About this tip
This tip is based on Wi24rd’s guide Shodan.io Netværks Monitor from August 2024, shared on LinkedIn (in Danish) with screenshots of every step. Price, number of addresses and button names were checked again on 1 November 2026.
Wi24rd has no financial interest in Shodan – no money, discounts or services. It is recommended because it works.
Missing a tip?
Write what you would like explained. The next security tip could be yours.