Shodan Query Builder

IoT & Device Search Engine Query Generator

625 Pre-built Queries12 Categories5 Search Engines

Security Research Notice

This tool is intended for authorized security research only. Searching for and interacting with devices without proper authorization may violate laws in your jurisdiction. Always ensure you have written permission before conducting any security assessments. The queries provided are for educational purposes to understand attack surfaces.

Total Queries
625
Categories
60 results
🏭

Industrial Control Systems

SCADA systems, PLCs, Modbus, BACnet, and industrial protocols

port:502

Modbus TCP protocol (default port)

highmodbusplc
"Modbus Device" port:502

Modbus devices on standard port

highmodbus
"Modbus/TCP"

Modbus TCP protocol banner

highmodbusprotocol
"Modbus Bridge"

Modbus bridge devices

highmodbusbridge
port:102

Siemens S7 protocol (ISO-TSAP)

criticalsiemenss7plc
"Siemens" port:102

Siemens PLCs on S7 port

criticalsiemensplc
"S7-300" OR "S7-400"

Siemens S7-300/400 PLCs

criticalsiemensplc
"S7-1200" OR "S7-1500"

Siemens S7-1200/1500 PLCs

criticalsiemensplc
"Siemens, SIMATIC"

Siemens SIMATIC controllers

criticalsiemenssimatic
port:47808

BACnet building automation

mediumbacnetbuilding
"BACnet" port:47808

BACnet protocol services

mediumbacnet
"BACnet Broadcast"

BACnet broadcast management

mediumbacnet
product:"BACnet"

BACnet product identification

mediumbacnet
port:20000

DNP3 protocol (common port)

highdnp3scada
"DNP3"

DNP3 protocol banners

highdnp3
port:19999 OR port:20000

DNP3 common ports

highdnp3
port:44818

EtherNet/IP protocol

highethernet-ipcip
"EtherNet/IP"

EtherNet/IP devices

highethernet-ip
port:2222 "EtherNet/IP"

EtherNet/IP alternate port

highethernet-ip
"Allen-Bradley"

Allen-Bradley PLCs

highallen-bradleyrockwell
"Rockwell Automation"

Rockwell automation devices

highrockwell
"ControlLogix"

ControlLogix PLCs

highallen-bradleycontrollogix
"CompactLogix"

CompactLogix PLCs

highallen-bradleycompactlogix
"MicroLogix"

MicroLogix PLCs

highallen-bradleymicrologix
"Schneider Electric"

Schneider Electric devices

highschneider
"Modicon"

Modicon PLCs

highschneidermodicon
"Quantum" PLC

Quantum PLCs

highschneiderquantum
"Unity Pro"

Schneider Unity Pro

mediumschneidersoftware
"GE Automation"

GE industrial automation

highgeautomation
"GE Fanuc"

GE Fanuc PLCs

highgefanuc
"PACSystems"

GE PACSystems

highgepacsystems
"Mitsubishi" "PLC"

Mitsubishi PLCs

highmitsubishiplc
"MELSEC"

MELSEC PLCs

highmitsubishimelsec
"iQ-R" OR "iQ-F"

Mitsubishi iQ series

highmitsubishiiq
"Omron" port:9600

Omron FINS protocol

highomronfins
"Omron" "PLC"

Omron PLCs

highomronplc
"CJ2" OR "CP1" Omron

Omron CJ2/CP1 series

highomron
http.title:"SCADA"

SCADA web interfaces

criticalscadaweb
http.title:"HMI"

HMI web interfaces

highhmiweb
"WinCC"

Siemens WinCC SCADA

criticalscadawincc
"InTouch"

Wonderware InTouch

criticalscadaintouch
"iFIX"

GE iFIX SCADA

criticalscadaifix
"Moxa" port:4800

Moxa serial device servers

highmoxagateway
"Lantronix"

Lantronix serial servers

mediumlantronixgateway
"Digi Connect"

Digi serial converters

mediumdigigateway
"Red Lion"

Red Lion industrial devices

highredlion
"IEC 61850"

Power utility protocol

criticaliec61850power
port:102 "ABB"

ABB power devices

criticalabbpower
"SEL-" relay

SEL protective relays

criticalselrelay
port:4840

OPC UA protocol

mediumopcua
"OPC" "Server"

OPC servers

mediumopc
product:"OPC"

OPC product banners

mediumopc
vuln:CVE-2019-12255

VxWorks TCP/IP vulnerability (URGENT/11)

criticalcvevxworks
vuln:CVE-2020-11896

Ripple20 vulnerabilities

criticalcveripple20
tag:ics

Shodan ICS-tagged devices

highshodanics
port:1911 OR port:1912

Niagara Fox protocol

highniagarafox
"Tridium" OR "Niagara"

Tridium Niagara systems

hightridiumniagara
port:789

Red Lion Crimson protocol

highredlioncrimson
"CODESYS"

CODESYS runtime

highcodesysruntime
port:1200 "CODESYS"

CODESYS web visualization

highcodesys

Use responsibly • Authorized testing only • Respect privacy and laws