The Best Shodan Alternatives in 2026

GreyNoise analyzes untargeted internet scanning and attack activity reaching servers connected directly to the internet.

Netlas provides technical information about IP addresses, domains, websites, web apps, IoT devices and other assets.

LocalMonero and AgoraDesk have closed their peer-to-peer cryptocurrency trading platform.

FOFA maps internet-connected assets so security researchers and organizations can search services, devices, and vulnerability exposure.

OpenBuckets searches cloud storage systems for publicly exposed buckets and lets users filter results by file type.

ONYPHE scans IPs and URLs at internet scale for attack-surface discovery, management and cyber threat intelligence.

Explore threat research, advisories, and security information published by FortiGuard Labs.

gofoss.net guides users through replacing Google, Meta, and Microsoft services with free and open source alternatives.

This OSINT Toolkit page groups Google and Bing search operators for web research, including queries for sites, links and trends.

View Bitdefender’s map showing reported cyber threats and related activity.

Read Malwarebytes’ detection notes for PC Protect, a Windows system optimizer flagged as a potentially unwanted program.

Cisco Talos provides threat intelligence and directs reputation or categorization inquiries to its support site.

Sector035 archives weekly OSINT news articles, with a collection of published issues and updates to the migrated archive.

LocalBitcoins has closed its Bitcoin trading service, according to the site notice.

Criminal IP provides IP reputation analysis, attack-surface monitoring, fraud detection and threat intelligence.

Read Malwarebytes’ description of the PUP.IOBit detection, including its identification of potentially unwanted IObit software for macOS.

The MIT AI Risk Initiative produces authoritative data and frameworks to help you identify, prioritize, and manage the risks from AI.

This page warns users about counterfeit ReVanced sites and helps them identify official sources to avoid scams.

Read a report about GShade adding a computer reboot action after detecting a third-party updater, which its developer called anti-tamper behavior.

Speech Jammer uses audio masking to make speech harder to understand in a surrounding environment.

rifteyy publishes malware and ransomware analysis reports, reverse engineering breakdowns, and security research.

Explore a worldwide visualization of DDoS attacks through the Digital Attack Map.

Read an analysis reporting that Nekogram’s Android client contains a backdoor that collects phone numbers.

The OWASP Top 10 for LLM Applications describes risks and mitigations for generative AI apps.