{"uid":"cap_KhKo-R2CO8PbmHTESCiXk","slug":"sitecheck-web-intel-open-port-scanner-shodan-passive-b0fe9af1","name":"SiteCheck Web Intel – Open Port Scanner (Shodan Passive)","description":"Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). The record can be days old, and an address with no record returns known=false, which does not prove the ports are closed.","url":"https://api.webintel-api.workers.dev/api/security/open-port-scanner?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 1.1.1.1 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_GRk-jafUi8FZA-geMq_bv","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns the list of TCP ports Shodan has passively observed open on a given IPv4 address, using pre-collected scan data (not a live scan).","exampleAgentPrompt":"What TCP ports does Shodan's passive scan data show as open on 198.51.100.42? I don't need a live scan, just whatever Shodan already has recorded.","exampleUseCases":[{"title":"Threat intel triage for suspicious IP","prompt":"I'm investigating a suspicious IP address — 203.0.113.15 — that showed up in our logs. Can you check what ports Shodan has passively observed open on it so I know what services it might be running?"},{"title":"Attack surface audit for own server","prompt":"Pull up Shodan's passive scan record for our server at 104.21.55.200 and tell me every TCP port they've seen open on it — I want to know if anything unexpected is exposed."},{"title":"Vendor security due diligence","prompt":"We're onboarding a new vendor and I want to check the network exposure of their IP 185.220.101.34 — can you look up what open ports Shodan's pre-collected data shows for it?"}],"resultDescription":"Returns a list of TCP port numbers Shodan has previously observed open on the given IPv4 address, along with a 'known' boolean indicating whether Shodan has any record for that address at all. If known=false, no scan data exists for that IP (which does not confirm the ports are closed). The data may be days old and reflects passive collection, not a live connection attempt.","failureModes":["IP not in Shodan's database returns known=false with no port list","Invalid or non-public IPv4 address may return an error or empty response","Stale data: ports shown as open may have since been closed","IPv6 addresses are not supported","Rate limiting or payment failure returns an HTTP error"],"whenToPreferThis":"Use this endpoint when you need a quick, non-intrusive lookup of what TCP ports have historically been visible on an IPv4 address, without triggering a live scan. Ideal for threat intelligence triage, attack surface auditing, and vendor risk assessments where passive data is sufficient. Prefer this over live scanning tools when stealth, speed, or avoiding active connection probing is important. Not suitable when you need real-time accuracy or when the IP has no Shodan record.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:44:37.870Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-open-port-scanner-shodan-passive-b0fe9af1"}