diff --git a/http/exposed-panels/airos-detect.yaml b/http/exposed-panels/airos-detect.yaml
index 872a18bd38..dadadf0f9c 100644
--- a/http/exposed-panels/airos-detect.yaml
+++ b/http/exposed-panels/airos-detect.yaml
@@ -6,6 +6,10 @@ info:
   severity: info
   description: |
     This template checks if the AIROS logo image is exposed at `/images/airos_logo.png` endpoint. If it returns a status code 200, it might indicate exposure of sensitive resources.
+  tags:
+    - airos,detection,exposed
+  metadata:
+    shodan_query: "http.favicon.hash:-697231354"
 
 requests:
   - method: GET