runsonwhat

Shodan's tech stack

What does Shodan use?

Shodan (shodan.io) uses at least 8 tools we can see from public records, including Microsoft 365 for email and documents, UptimeRobot for monitoring, Cloudflare for content delivery and Anthropic for AI. Last checked .

Industry
Computer & Network Security
Size
1–10 employees
Based in
Seattle, United States
Founded
2009
LinkedIn
Company page
Re-check liveVisit shodan.io
Tools found
8
Categories
6
Layers
5 of 5
Last checked
Oct 2026

Shodan's stack, layer by layer

Each tool links to the other companies we've found using it. The label says what kind of public trace gave it away.

Edge & Hosting

1 tool, where the bytes are served from

CDN & Edge

Application

3 tools, what the product is built with

AI

Media & UI

Data & Observability

1 tool, what they measure and store

Monitoring

Go-to-market

1 tool, how they find and keep customers

Marketing

Company Ops

2 tools, what the team runs on day to day

Workspace

Companies like Shodan also use

Tools common among companies with a similar stack that we haven't found at Shodan.

Companies with a stack like Shodan's

Ranked by shared tools, with rare tools counting more.

Shodan tech stack FAQ

What tools does Shodan use?

We've found 8 tools at Shodan (shodan.io). Edge & Hosting: Cloudflare. Application: Anthropic and Font Awesome. Data & Observability: UptimeRobot. Company Ops: Microsoft 365 and Google Workspace. Last checked October 1, 2026.

What email provider does Shodan use?

Shodan uses Microsoft 365 and Google Workspace for email and documents. We found Microsoft 365 through DNS verification records.

Does Shodan use Microsoft 365?

Yes. We found Microsoft 365 at Shodan through DNS verification records. Microsoft 365 is used by 245,233 companies we track.

How does runsonwhat know what Shodan uses?

We read public traces only: Shodan's DNS and email records, certificate logs, the code its website loads, and published subprocessor lists. A tool is listed only when a direct record backs it up. DNS is rechecked weekly and the website monthly.

We read public traces only: DNS and email records, certificate logs, website code and published subprocessor lists. A tool is listed when a direct record backs it up, and dropped when a recheck no longer finds it. Is this your company? See how to opt out.