skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-ip-reputation-analysis-with-shodan

Analyze IP reputation using the Shodan API to identify open ports, services, and vulnerabilities.

4|Updated Apr 28, 2026
Search Tags:#vulnerability#reconnaissance#threat intelligence#enrichment#shodan#ip reputation#soc triage
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-ip-reputation-analysis-with-shodan-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-ip-reputation-analysis-with-shodan
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-ip-reputation-analysis-with-shodan
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-ip-reputation-analysis-with-shodan-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires shodan, requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? Security analysts need fast, evidence-based context on suspicious IP addresses during alert triage and threat intelligence work, but manually querying Shodan and correlating results across many IPs is slow and error-prone. ## Core Features & Use Cases - Single-IP Enrichment: Query the Shodan API for open ports, running services, SSL certificates, known CVEs, ASN, ISP, and geolocation, with an automatic reputation score and threat level. - Batch Reputation Analysis: Process lists of IPs with rate limiting, sort results by risk score, and summarize counts by critical/high/medium/low severity. - Infrastructure Correlation: Find related hosts sharing the same organization or SSL certificate to map attacker infrastructure. - Use Case: A SOC analyst receives 50 suspicious IPs from firewall logs, runs the bulk lookup with Shodan and AbuseIPDB keys, and immediately gets a risk-ranked JSON report for triage. ## Quick Start Ask the agent to look up the reputation of a suspicious IP address using your Shodan API key and summarize its open ports, vulnerabilities, and risk level.

Frequently Asked Questions about performing-ip-reputation-analysis-with-shodan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check IP reputation with the Shodan API in Python?▼

Install the shodan library, initialize it with your API key, and call api.host(ip) to retrieve open ports, services, vulnerabilities, ASN, and geolocation. The skill's agent.py wraps this in a lookup command that outputs structured JSON.

How to analyze multiple IP addresses for threat intelligence?▼

Use the bulk command with a list of IPs to run Shodan host lookups for each address, optionally adding AbuseIPDB checks. Results are risk-classified as critical, high, medium, or low based on abuse confidence scores and vulnerability counts.

Shodan vs InternetDB for IP enrichment, which should I use?▼

InternetDB (internetdb.shodan.io) is a free, unauthenticated API returning ports, hostnames, tags, CPEs, and vulnerabilities, suited for high-volume lookups. The full Shodan API provides richer data like banners, SSL certificates, and geolocation but consumes query credits.

Does the Shodan API require a paid plan for IP lookups?▼

A free Shodan account provides an API key with limited query credits, which is enough for occasional host lookups. Paid plans raise rate limits and unlock streaming and search features; InternetDB remains free without authentication.

Why does my Shodan host lookup return an error for an IP?▼

Shodan raises an APIError when the IP has no scan data in its database, the API key is invalid, or query credits are exhausted. The agent catches these errors and returns them in the JSON output instead of failing.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

analyzing-email-headers-for-phishing-investigation

Parse email headers and DNS records to trace phishing origins.

Community
Intermediate
starwreckntxstarwreckntx

Security Orchestration Agent

Automate security playbooks and incident-response workflows across security swarm agents.

Community
Basic
xalgordxalgord
954

building-adversary-infrastructure-tracking-system

Track adversary C2 infrastructure using passive DNS, WHOIS, and certificate pivots.

Community
Advanced
taracodlabstaracodlabs
779

shodan

Identify exposed internet devices and services via Shodan API queries.

Official
Intermediate