A careful Shodan workflow for domain server discovery
Shodan is a passive search engine that indexes exposed services and their banners. Looking up a domain’s server IP can reveal ports, software clues and network ownership, but results are historical observations rather than proof of what is running now.
Using it defensively starts with permission. Search only an address or network you own or have written authority to assess, keep queries narrow, and avoid login attempts, exploit checks or high-volume probing. This supports a defensible audit trail.
For the named domain, the name suggests Pasuruan local news, while the supplied background describes a cPanel login and unrelated Mogeqq card and dice gaming content. That mismatch warrants observation, not a claim about the current owner.
Confirm scope and current DNS
Only inspect an IP address or network covered by your assessment scope. A domain relationship is not, by itself, permission to investigate every service sharing its infrastructure, especially on Australian cloud, reseller or shared-hosting plans.
Resolve current records with dig +short A tribratanews-pasuruan.com and dig +short AAAA tribratanews-pasuruan.com. Record every returned address and its timestamp, then compare it with any delegated hostname or CDN address. Sydney and Melbourne teams should identify whether they used Australian Eastern Standard or Daylight Time and include the UTC offset.
Record visible site evidence separately from network findings. Begin with the domain’s current page to note whether visitors see news, a hosting login, an error or another service; DNS and Shodan data cannot make that content assessment.
Separate DNS from ownership evidence
Four signals answer different questions:
| Signal | Useful evidence | Does not prove |
|---|---|---|
| A or AAAA record | Current DNS mapping at lookup time | Dedicated control or physical location |
| Shodan host record | Indexed service banners and last-seen time | Current availability or vulnerability |
| Reverse DNS | Infrastructure naming convention | Domain ownership |
| ASN and netblock | Registered network operator | Operator identity behind the domain |
DNS records may rotate, use CDNs or point to shared hosting. Shodan may also lag the live service. A Sydney or Melbourne office location, an Australian registrant and a domain name referencing Pasuruan are separate facts, not substitutes for ownership evidence.
Build a focused Shodan search
Paste the exact address into Shodan as ip: or select it from the host view. Start with ip: and port: filters to avoid unrelated hosts. Restrict further with product:, hostname: or certificate fields only when those values came from your own DNS records.
After validating a single host, use net: or asn: only when the wider network is authorised. Keep an allowlist of expected ports and compare it with indexed ports; unexpected services deserve investigation, not automatic incident labelling.
Filters such as country:AU or city:Sydney can help organise Australian assets, but Shodan’s geolocation is approximate and should not be treated as proof of physical placement.
Read banners as observations
An indexed port is often called an open service, but the observation may be stale. Note the port, protocol, banner, timestamp, last-seen data, certificate names, hostnames and software labels. Compare them with the expected web, mail, DNS or control-panel architecture.
Treat vendor and version strings as leads, not findings of exploitable weakness. Banners can be altered or misleading, and Shodan coverage differs between IPv4, IPv6 and smaller services. Never execute copied banner content or try credentials against it.
Account for shared hosting
A domain can resolve to a CDN edge or shared cPanel IP where many tenants appear. In that situation, unrelated banners or Mogeqq pages cannot be attributed to the domain’s owner without corroboration.
The supplied history includes unrelated gaming material. Plain-language domain history can separate name changes, historical addresses and present observations for non-specialist stakeholders; it does not assign shared-server content to a particular tenant.
Australian teams often administer .au and .com.au estates alongside global domains. For eligible Australian domains, auDA WHOIS is a useful status source, but registration country is not server location.
Verify and document findings
A sound review can be reduced to these checks:
- Confirm written authorisation, target IP ranges and the assessment window.
- Save the exact Shodan query, timestamp, screenshot or export and host-page address.
- Record DNS resolver output separately from every indexed service observation.
- Recheck stale results against owner-approved sources or another passive database.
- Mark CDN use, shared tenancy, unsupported banners and probable false positives.
- Connect each verified observation to the expected service and responsible owner.
Document what was seen, its source, timestamp, confidence level, limitations and remediation path. For audit workflows, Doca sensor findings illustrates the value of traceable sensor evidence. Australian teams can also follow ACSC guidance on exposed services and patching. If collected material contains personal information, the Privacy Act 1988 and Australian Privacy Principles may apply.
Keep the finding proportionate
Shodan can reveal useful leads about ports, software and hosting, but it does not establish ownership, current reachability or compromise. The named domain’s inconsistent public history should therefore be treated as an attribution problem requiring corroboration.
Remember the durable lesson: passive discovery narrows the investigation; verified DNS, network ownership and authorised validation determine whether an exposed service is genuine, relevant and reportable.