Web server check
Find out who actually hosts a site, and what's running on the machine.
Checks run in parallel, and slow ones time out rather than hold up the rest.
What gets checked
SSL Certificate
Certificate issuer, validity dates and the chain of trust
Headers
Every HTTP response header the server sends back
Server Location
Where in the world the server is physically hosted
Associated Hosts
Other hostnames Shodan has seen on the same IP address
Server Status
Whether the site is up, and how quickly it responded
Open Ports
Which common ports are open and reachable on the host
Traceroute
The network path packets travel to reach the server
Server Info
Operating system, ASN and the network the host sits on
Vulnerabilities
CVEs Shodan links to the services running on the host
Tech Stack
Frameworks, analytics and services the site is built with
Firewall
Which web application firewall, if any, sits in front of the site
TLS Connection
The version, cipher suite and details of a live TLS handshake
What this tells you
A domain is only the front door. Behind it is a machine somewhere physical, running an operating system and a web server, with some set of ports listening and a specific route that packets take to get there.
You can work most of that out from the outside, and it usually says more about who runs a site than the page itself ever will.