CIPHERCUE
Looking for a Shodan alternative?

Shodan searches the internet. CipherCue tracks the accounts you care about.

Two different jobs. If you need a fixed list of accounts watched every day, with changes delivered to your CRM, this is what we do.

See a 30-minute walkthrough Talk to us about what you need.

What each tool is for

Two different jobs, with overlap at the edges. Here is what each one does well.

Recommended for what brought you here

Use CipherCue for

  • Daily observation of a fixed account list, with a stored 30 / 60 / 90 day change history per entity.
  • Alerts the moment something changes on a tracked account, scoped to the change types you care about.
  • Native HubSpot and Attio delivery: observations land as timeline events on the account record, no glue code required.
  • Daily CISA KEV matches against detected software on the public perimeter, with the authority source on every row.
  • Subdomain discovery from certificate transparency logs, recorded the day each certificate is issued.
  • DNS and email policy diffs (SPF, DKIM, DMARC, MX) so configuration drift is visible the day it happens.
Different tool, different job

Use Shodan for

  • Searching the whole public internet for exposed services.
  • Running ad-hoc queries in the Shodan query language.
  • One-off reconnaissance for pentests or bug bounty work.
  • Pulling raw scan data via API into your own pipeline.

Sound like what you need?

30 minutes. Three accounts from your list. Honest conversation.

Book a walkthrough →
Illustrative

Observations timeline · Acme Corp · last 30 days

2026-05-22 CISA-listed software observed. Apache HTTP Server 2.4.37 detected on www.example.com. Matches CISA KEV CVE-2021-41773, added 2021-11-03.
2026-05-21 New subdomain observed in CT log. staging-eu.example.com issued a Let's Encrypt certificate. Authority: crt.sh log entry.
2026-05-19 Email policy changed. DMARC record on example.com shifted from p=none to p=reject. Authority: DNS observation 19:04 UTC.
2026-05-17 Tech stack changed. Cloudflare CDN appeared on api.example.com. Previous CDN: Akamai. Authority: Direct HTTP observation.
2026-05-14 New TLS certificate issued. portal.example.com rotated from a 90-day Let's Encrypt cert to a DigiCert 1-year cert. Authority: crt.sh log entry.

Illustrative example. Hostnames replaced with example.com placeholders.

See it on your own accounts

30 minutes. We pick three accounts you care about and show you what we have observed about them over the last 30 days. Early access: no public pricing yet, no free tier. Talk to us about what you need.