2026 Internet Asset Search Pricing Comparison

Shodan, Censys, ZoomEye, FOFA, Netlas

From Research Budgets to CVE Filtering and Target Tracking

Security researchers usually choose an internet asset search tool around a specific task: finding exposed services, identifying assets potentially associated with a vulnerability, or tracking changes to targets over time. The number of results needed, API automation requirements, and whether the work is commercial determine which plan is actually required.

Price differences among Shodan, Censys, ZoomEye, FOFA, and Netlas reflect both resource allowances and the tiers at which features become available. Comparing entry costs first, then the actual requirements for result retrieval, vulnerability filtering, and monitoring, makes it clearer what the budget pays for.

01 Entry Subscriptions and What the Monthly Fee Includes

The prices above are monthly subscription prices in US dollars on the international sites, using the actual discounted prices for ZoomEye and FOFA. Monthly subscriptions, annual prices expressed as monthly equivalents, and crossed-out list prices are different pricing bases. This article compares monthly subscriptions only. [1–5]

ZoomEye has the lowest entry cost among these monthly plans. Like FOFA Personal, it includes up to 100,000 results per month and an API rate of 1 request per second, but costs $6 less per month, a reduction of 24.0%. Shodan and Netlas offer entry-level result limits of 1 million, along with resources such as scanning, making further comparison useful at higher workloads.

Other options exist for light use: all five platforms offer free tiers. Shodan Membership is a one-time $49 account upgrade that includes 100 Query Credits per month and monitoring for 16 IPs. It serves a different need from an API plan purchased on an ongoing monthly basis. [1]

02 Budgeting for 100,000 Search Results

Assume a single month of non-commercial research, suitable queries already prepared, an unused monthly allowance, and no rollover credits. The task retrieves search results without looking up full details for every record. The comparison below considers whether each plan can support this workload; results are counted as each platform’s native records.

Shodan deducts Query Credits when filters are used or page 2 and subsequent pages are requested. An initial query without filters may not consume a credit. Scan Credits are counted separately and do not use Query Credits. The estimate of 1,000 credits in the table assumes 100 billable results per page. [6]

Censys Starter allows access to at most 5 pages, or 500 results, per query, so retrieving 100,000 results also requires appropriately splitting queries. Even if all 5 free daily actions over 31 days were used for this task, 500 credits plus 155 free actions would still be insufficient. Starter Pro, at $599/month, provides 4,000 credits and can cover the idealized pagination budget, but does not remove the per-query limit. Detail lookups and bulk detail retrieval consume additional credits. [2][7][8]

The entry-level result limits of both ZoomEye and FOFA can accommodate this volume, with ZoomEye costing less per month. Actual searches and repeated downloads also consume resources, so tasks that reach the limit should allow some headroom. Netlas offers a larger result allowance, but its per-download limit requires batching. [3–5]

Temporary Capacity Increases and Ongoing Subscriptions Require Different Budgets

ZoomEye sells additional credit packages, while FOFA sells F Points, which can be used for additional queries or downloads. Whether to buy extra capacity also depends on existing account permissions and the specific charging rules. The price comparisons here include subscriptions only. Nor do 100,000 results equal 100,000 unique assets: deduplication, retries, and supplementary detail lookups need separate allowances. [3][4]

03 How Resources Change at Higher Tiers

Entry prices show the initial outlay; ongoing research also depends on what the next tier adds. The main upgrade paths below distinguish capacity, investigation actions, and feature access. [1–5][8]

Comparable Core Allowances Reveal Differences at Specific Tiers

ZoomEye Professional and FOFA Professional both offer up to 800,000 results per month and an API rate of 1 request per second. Their monthly fees are $109 and $119 respectively, making ZoomEye $10, or approximately 8.4%, less expensive. Both Business plans offer 2 API requests per second and include commercial use. At $1,099 and $1,199 per month respectively, ZoomEye costs $100, or approximately 8.3%, less.

Capacity further differentiates the Business plans: ZoomEye offers up to 10 million results per month, 1 million more than FOFA’s 9 million, an increase of approximately 11.1%. FOFA, however, explicitly includes 5 users. Result capacity, query credits, returned fields, and seat entitlements still differ and should be matched to the actual workflows. [3][4]

Bulk Retrieval and Investigation Access Follow Different Upgrade Paths

Shodan Small Business increases query, scan, and monitoring allowances together. Censys Starter Pro adds to the action budget while retaining the Starter tier’s data access boundaries. Netlas Business offers a 25 million result limit for $249/month, making it relevant when comparing budgets primarily for high-volume retrieval.

ZoomEye therefore has a price advantage for entry-level research and for the core allowances of the corresponding FOFA tiers discussed above. When the task shifts to retrieving tens of millions of results, accessing specific data, or supporting collaboration, the resources that determine cost also change.

04 CVE Filtering and the First Supporting Tier

Vulnerability investigations often start with a CVE identifier to find potentially related internet assets. Displaying CVE information on a detail page and allowing an account to search by CVE are separate permissions. The table below compares the standard-plan features directly relevant to this task.

Among Shodan, ZoomEye, and Netlas, which publish monthly prices for the relevant filtering capability, ZoomEye Professional has the lowest subscription entry cost. It is $250/month, or approximately 69.6%, less than Shodan Small Business, and $140/month, or approximately 56.2%, less than Netlas Business. This difference directly relates to finding assets by CVE, rather than simply comparing each platform’s lowest monthly fee. [1][3][10]

Shodan Freelancer at $69/month does not unlock vuln. Netlas Freelancer at $49/month includes CVE data, but CVE and tag search filters are available only from Business upward. Censys places CVE data in the Core access tier; increasing the Starter credit allowance does not unlock this data tier. [1][8][10]

FOFA’s product, service, and version filters can help identify related assets, but its public plans do not list native CVE identifier filtering as a separately priced item. The comparison here therefore distinguishes retrieval methods, rather than treating product-syntax searches as equivalent to a CVE filter. [4]

The Value of Professional Comes from Its Feature Combination

ZoomEye’s $109/month plan combines an 800,000 monthly result limit, CVE filtering, and BugBounty Radar (SRC Radar). For researchers who first filter assets by vulnerability scope and then track bounty targets, this combination is more relevant than result counts alone. [3][14]

CVE associations help narrow the investigation scope. Actual risk still depends on deployed versions, configurations, and remediation status. The price differences above reflect feature access under standard subscriptions; special arrangements such as educational access are outside the comparison.

05 Continuous Tracking Starts with What Is Monitored

Continuous tracking may focus on fixed IPs, collections of assets matching a query, or bug bounty programs. Their units of coverage and triggering events differ, so entry options, capacity, and notification methods need separate comparison.

Shodan supports alerts around IPs or network ranges, as well as dynamically maintaining the relevant IPs from domain names. Triggers such as new services determine when notifications are sent. Monitoring a small number of fixed IPs is already available through the one-time Membership upgrade. [1][11]

Censys Collections track assets added to or removed from a query’s matching results. The free tier does not include webhooks; automated notifications are available from Starter upward. Creating and maintaining collections does not incur additional credits, while searches and reports within them still consume credits by action. [13]

ZoomEye already offers target subscriptions in its free tier, and Personal and Professional have the same number of subscription targets. Professional’s added value mainly comes from combining CVE filtering, a higher result allowance, and SRC Radar. SRC Radar tracks assets such as bug bounty program domains and subdomains, supporting ongoing research into target scope. [3][14]

FOFA Corporate V2 integrates monitoring with enterprise asset inventories. Netlas provides private scanning and attack surface discovery tools. Scan target counts measure scanning capacity, while asset node counts measure the scale of asset mapping; neither directly represents continuous alerting capacity. [4][5][9]

ZoomEye’s subscription value is therefore more evident in the combination of vulnerability searches and bounty target tracking. Fixed-IP alerts, query-collection notifications, and enterprise attack surface management follow different product paths.

06 API Access and Licensing in the Actual Workflow

Request rates determine the pace of automation. API and data permissions determine what can be retrieved, while commercial and team licensing determine how it can be used. All three requirements must be met.

Shodan’s account user counts and its rules for using an API key within an organization are different: the latter permit sharing among multiple people. Censys’s limit of 1 concurrent action also does not mean 1 request per second. Netlas’s per-minute rate limits, daily request limits, and monthly result allowance separately constrain request pace and total usage. [1][8][9]

ZoomEye’s and FOFA’s field counts reflect their respective API designs; the numbers alone do not measure information completeness. What matters is whether the ports, protocols, certificates, timestamps, or vulnerability information needed for the task can be returned, and whether the relevant historical data and filtering permissions are available. [3][4]

Choosing a Subscription for a Specific Task

Shodan combines search, scanning, and IP monitoring. Censys budgets need to account for investigation actions and data tiers. ZoomEye lowers the entry cost for light non-commercial research to $19/month; at $109/month it combines CVE filtering, 800,000 results, and SRC Radar. FOFA’s tiered query resources, syntax access, and 5-user Business plan should be assessed against existing workflows. Netlas’s high monthly result limits and batch downloading capabilities merit consideration for bulk retrieval.

For light result retrieval and non-commercial research requiring CVE filtering, ZoomEye’s price advantage is supported by specific plan entitlements. Commercial projects, multiple users, or higher data volumes require the budget to be reassessed against licensing and resource needs.

Pricing Notes and Sources

Pricing date: November 5, 2026. All prices are in US dollars and use actual monthly subscription prices on the international sites. Taxes, regional charges, usage-based add-ons, and custom contracts are additional. Percentage differences use the compared plan’s price as the denominator and are rounded to one decimal place. Result limits are plan allowances, not evidence of identical asset coverage or the number of unique assets that can actually be retrieved. Official pages and order terms govern prices and entitlements.

[1] Shodan plans, credits, monitoring, and API licensing
https://account.shodan.io/billing

[2] Censys Starter and Starter Pro
https://docs.censys.com/docs/platform-starter-subscriptions

[3] ZoomEye pricing, result allowances, and feature access
https://www.zoomeye.ai/pricing

[4] FOFA monthly plans and F Points
https://en.fofa.info/vip

[5] Netlas monthly plans and retrieval allowances
https://netlas.io/pricing/

[6] Shodan query and scan credits
https://help.shodan.io/the-basics/credit-types-explained

[7] Censys Free and Starter credit rules
https://docs.censys.com/docs/platform-credits-free-starter

[8] Censys data and feature access tiers
https://docs.censys.com/docs/data-access-tiers-entitlements

[9] Netlas API rate limits and scanning endpoints
https://docs.netlas.io/api-reference/

[10] Netlas CVE filtering and bulk download guidance
https://docs.netlas.io/faq/

[11] Shodan network monitoring and notification triggers
https://help.shodan.io/command-line-interface/4-network-monitoring

[12] Shodan educational access
https://help.shodan.io/the-basics/academic-upgrade

[13] Censys Collections and webhooks
https://docs.censys.com/docs/platform-collections

[14] ZoomEye features and SRC Radar guidance
https://www.zoomeye.ai/help