DevCop95/shodan_reconsx

What it is

recons101x (repo DevCop95/shodan_reconsx), latest release v1.0.5 (2026-08-17) — note the limits/progress/reliability behavior described is Unreleased but still carries the 1.0.5 version. Requires Python 3.10+, no third-party packages, no Shodan API key. The summary covers the passive CT-log enumeration and status states; below are the operational details an integrator needs that it omits.

Automation contract

Check the exit code before consuming results — the tool overloads them:

• 0 success
• 1 query, output-write, or deadline (timeout) error
• 2 invalid arguments/input
• 130 interrupt

stdout carries only data (TXT is domain<TAB>hostname, or domain<TAB>hostname<TAB>ip1,ip2 with --resolve); banner, status, and counters go to stderr, so pipes stay clean.

Tuning defaults: --workers 10, --timeout 15 (per CTL op), --probe-timeout 3 (per probe), --retries 2. None of the timeouts is an overall deadline — only --max-time is. Timeout values reject NaN/infinity and must be positive finite.

--live is a composite switch equal to --resolve --probe --active-only --status. It is active traffic, not passive enumeration. TCP reachability alone keeps a host; HTTP is not required.

The timeout trap

--max-time runs the scan in a separate spawned process, killed on expiry even if DNS is stuck. Critical caveat stated by the page:

results in progress are not checkpointed, and unfinished scan output is not guaranteed. Do not treat a previous or existing output file as a new successful result after a timeout.

A deadline returns exit code 1 — combined with the point above, a stale output file from a prior run can look like success. Gate on the exit code, not file presence.

Certificate enrichment is JSON-only

./scan.sh example.com --certificates --max-certificates 5 --max-time 60 --progress --format json --output results.json

--certificates fetches /api/v1/cert/{sha256} and adds a certificates array. A limit alone (--max-certificates) does not enable fetching. TXT output silently drops the certificate data even though the requests still fire — use --format json or you pay the network cost for nothing.

Caveats

The DNS/TCP/HTTP/stale counters cover only hostnames selected by --max-hosts, computed before --active-only filtering — not the full CTL inventory when capped. HTTP_REACHABLE includes 4xx/5xx responses and does not mean the service is healthy. Because CT logs contain old names, treat DNS activity as a first filter only.