{"uid":"cap_l9_Kb6GRyur7CWKJONUuS","slug":"sitecheck-web-intel-ssh-banner-audit-621ab688","name":"SiteCheck Web Intel SSH Banner Audit","description":"From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) list. This is passive and may be days old; it is not a live SSH banner grab or algorithm audit.","url":"https://api.webintel-api.workers.dev/api/security/ssh-banner-audit?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 185.220.100.240 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"ip":"185.220.100.240","known":true,"source":"https://internetdb.shodan.io/185.220.100.240","checkedAt":"2026-10-23T09:38:35.886Z","opensshVersion":"10.0p2","sshPortSeenOpen":true}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Y-Vs6l9dAVRYIkv_IAWg2","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up the SSH banner (OpenSSH version) and whether port 22 is open for a given IPv4 address, using public internet scan data.","exampleAgentPrompt":"Can you check whether the IP 185.220.100.240 has SSH port 22 open and tell me what OpenSSH version it's running?","exampleUseCases":[{"title":"Auditing SSH exposure on suspicious IP","prompt":"I got a login attempt from 203.0.113.45 — can you check if that IP has port 22 open and what SSH version it's running?"},{"title":"Checking SSH version on a new server","prompt":"We just provisioned a server at 198.51.100.12 — can you pull its SSH banner and confirm what OpenSSH version is reported publicly?"},{"title":"Screening known Tor exit node for SSH risk","prompt":"Is the IP 185.220.101.33 running SSH? I want to know if port 22 is open and what version of OpenSSH it's advertising."}],"resultDescription":"Returns a JSON object containing the queried IP, a boolean indicating if it is known in public scan data, the OpenSSH version string (e.g. '10.0p2'), whether SSH port 22 was seen open, the source URL (Shodan InternetDB), and the timestamp of the check.","failureModes":["IP not found in scan data — 'known' field returns false and SSH fields may be absent","Invalid or non-IPv4 address input returns a validation error","Rate limiting or payment failure results in no charge and no data returned","Scan data may be stale if the IP hasn't been recently re-scanned by Shodan"],"whenToPreferThis":"Choose this endpoint when you need a quick, no-signup lookup of SSH banner and port-22 exposure for a specific IPv4 using public internet scan data. It is ideal for threat triage, incident response enrichment, or infrastructure auditing where you need SSH version info without running an active scan yourself. Prefer this over active port scanning tools when passively sourced data is sufficient and you want instant results at low cost.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:15.827Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-ssh-banner-audit-621ab688"}