diff --git a/README.md b/README.md
index 03423b5..6973001 100644
--- a/README.md
+++ b/README.md
@@ -137,6 +137,40 @@ Performs comprehensive DNS reconnaissance on a domain. Shows A, AAAA, MX, NS, TX
 **💰 !btc**
 Fetches the current Bitcoin price in USD from bitcointicker.co API.
 
+### 🔍 Shodan Security Research
+
+**📡 !shodan [command] [query]**
+Shodan.io integration for security reconnaissance and threat intelligence.
+
+**Commands:**
+- `!shodan ip <ip_address>` - Detailed IP information (services, ports, banners)
+- `!shodan search <query>` - Search Shodan database with filters
+- `!shodan host <domain>` - Host information and subdomain enumeration
+- `!shodan count <query>` - Count results with geographic/organization breakdown
+- `!shodan test` - Test API connection and debug queries
+
+**Search Examples:**
+```bash
+!shodan search apache
+!shodan search "port:22 country:US"
+!shodan search "product:nginx city:'New York'"
+!shodan search "net:192.168.1.0/24"
+!shodan search "vuln:cve-2021-44228"
+!shodan search "http.title:'phpMyAdmin'"
+!shodan search "ssl.cert.subject.cn:'example.com'"
+
+Common Search Filters:
+    country:US - Filter by country
+    city:"New York" - Filter by city
+    port:80,443,8080 - Filter by ports
+    product:nginx - Filter by service/product
+    os:Windows - Filter by operating system
+    org:"Google" - Filter by organization
+    net:192.168.0.0/16 - Filter by network range
+    has_ssl:true - Has SSL certificate
+    http.title:"admin" - HTTP page title contains
+```
+
 ### AI & Generation Commands
 
 **🤖 AI Commands (!tech, !music, !eth, etc.)**
diff --git a/plugins/help.py b/plugins/help.py
index 7fbcfb5..b5dc203 100644
--- a/plugins/help.py
+++ b/plugins/help.py
@@ -77,6 +77,28 @@ async def handle_command(room,  message,  bot,  prefix,  config):
 <p>Fetches the current Bitcoin price in USD from bitcointicker.co API. Shows real-time BTC/USD price with proper formatting. Includes error handling for API timeouts and data parsing issues.</p>
 </details>
 
+<details><summary>🔍 <strong>!shodan [command] [query]</strong></summary>
+<p>Shodan.io integration for security reconnaissance and threat intelligence.</p>
+<p><strong>Commands:</strong></p>
+<ul>
+<li><code>!shodan ip &lt;ip_address&gt;</code> - Detailed IP information (services, ports, banners)</li>
+<li><code>!shodan search &lt;query&gt;</code> - Search Shodan database with filters</li>
+<li><code>!shodan host &lt;domain&gt;</code> - Host information and subdomain enumeration</li>
+<li><code>!shodan count &lt;query&gt;</code> - Count results with geographic/organization breakdown</li>
+<li><code>!shodan test</code> - Test API connection and debug queries</li>
+</ul>
+<p><strong>Search Examples:</strong></p>
+<ul>
+<li><code>!shodan search apache</code></li>
+<li><code>!shodan search "port:22 country:US"</code></li>
+<li><code>!shodan search "product:nginx"</code></li>
+<li><code>!shodan search "net:192.168.1.0/24"</code></li>
+<li><code>!shodan search "http.title:'admin'"</code></li>
+</ul>
+<p><strong>Common Filters:</strong> country, city, port, product, os, org, net, has_ssl, http.title</p>
+<p><em>Requires SHODAN_KEY environment variable</em></p>
+</details>
+
 <details><summary>📸 <strong>!sd [prompt]</strong></summary>
 <p>Generates images using self-hosted Stable Diffusion. Supports options: --steps, --cfg, --h, --w, --neg, --sampler. Uses queuing system to handle multiple requests. See available options using just '!sd'.</p>
 </details>