{"uid":"cap_cNkvRi8J38CU6f3IMPY0v","slug":"sitecheck-web-intel-ntp-port-123-passive-scan-lookup-ec41cd8e","name":"SiteCheck Web Intel NTP Port 123 Passive Scan Lookup","description":"Reports whether Shodan's pre-collected passive scan data shows NTP (port 123) seen open on an IPv4 address. Passive and possibly old; the monlist amplification check itself is not run, so this cannot say whether monlist is enabled.","url":"https://api.webintel-api.workers.dev/api/security/ntp-monlist-audit?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 129.6.15.28 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_1uyZuOu3y4YMLg6r4ywxP","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks Shodan's passive scan data to determine whether port 123 (NTP) has been observed open on a given IPv4 address","exampleAgentPrompt":"Can you check Shodan's passive scan data to see if port 123 (NTP) has been observed open on the IP address 129.6.15.28?","exampleUseCases":[{"title":"NTP exposure audit for a server","prompt":"I want to know if Shodan has ever seen port 123 open on 198.51.100.42 — can you check whether NTP appears to be exposed on that IP?"},{"title":"Security recon on a suspicious IP","prompt":"We flagged the IP 203.0.113.77 in our logs — can you pull Shodan's passive data to see if it's running NTP on port 123?"},{"title":"Pre-pentest NTP surface mapping","prompt":"Before our engagement, check whether Shodan shows NTP port 123 as open on 192.0.2.15 so we know if it's in scope for NTP-based checks."}],"resultDescription":"Returns whether Shodan's pre-collected passive scan data shows port 123 (NTP) as having been observed open on the specified IPv4 address. Note: this reflects historical passive data and does not perform a live scan or test for monlist amplification vulnerability — only port visibility is reported.","failureModes":["Invalid or malformed IPv4 address returns an error","IPv6 addresses are not supported","Shodan may have no data for the IP, returning no port observation","Data may be stale if Shodan has not recently scanned the IP","Private or RFC1918 addresses may return no results","Rate limiting or payment failure may block the request"],"whenToPreferThis":"Use this endpoint when you need a fast, passive check of whether NTP (port 123) is exposed on a given IPv4 address using Shodan's historical data, without triggering any active probe. Prefer this over active scanners when stealth or non-intrusiveness is required. Note: this cannot confirm whether monlist amplification is enabled — only that port 123 was observed open at some point in Shodan's data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:44:29.814Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-ntp-port-123-passive-scan-lookup-ec41cd8e"}