shodan-ip-lookup
Look up open ports, services, SSL certs, geolocation, and vulnerabilities from Shodan's passive database. Only query targets you are authorized to assess.
Instructions
Look up detailed information about an IP address using Shodan.
Returns open ports, services, banners, SSL certificates, geolocation, hostnames, vulnerabilities, and last seen date. This is PASSIVE reconnaissance — no packets are sent to the target.
IMPORTANT: Only query targets you are authorized to assess.
Returns: ShodanHostResult with detailed host information from Shodan's database.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | IP address to look up (IPv4 or IPv6). Example: "8.8.8.8" or "2001:4860:4860::8888". | |
| timeout | No | HTTP request timeout in seconds. Default: 30. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| os | No | Detected operating system | |
| asn | No | Autonomous system number (e.g., AS15169) | |
| isp | No | Internet service provider | |
| org | No | Organization that owns the IP | |
| ports | No | List of open ports | |
| vulns | No | Known vulnerability identifiers (CVE IDs) | |
| ip_str | Yes | IP address of the host | |
| location | No | Geolocation information | |
| services | No | Services detected on open ports | |
| hostnames | No | Hostnames associated with the IP | |
| last_update | No | Timestamp of when the host was last seen by Shodan |