performing-ip-reputation-analysis-with-shodan

What problem does it solve?

Security analysts triaging alerts need fast, reliable context on suspicious IP addresses, but manually checking open ports, services, and known vulnerabilities across sources is slow and error-prone. This Skill automates IP reputation analysis with the Shodan API and the free InternetDB API, producing scored, structured enrichment data for SOC triage and threat intelligence workflows.

Core Features & Use Cases

• Full IP Enrichment: Query the Shodan host API to retrieve open ports, service banners, SSL certificate details, CVEs, ASN, geolocation, and tags for any IP address.
• Reputation Scoring: Automatically score IPs based on vulnerability counts, suspicious ports, tags, and excessive exposed services, classifying them as low, medium, high, or critical.
• Batch Processing & Infrastructure Correlation: Enrich lists of IPs with rate limiting, and pivot on organization or SSL certificate attributes to find related infrastructure.
• Use Case: A SOC analyst receives an alert involving 50 external IPs. Use this Skill to batch-enrich all of them, sort by reputation score, and escalate only the critical ones for blocking.

Quick Start

Use the Shodan IP reputation skill to enrich the IP address 203.0.113.1 and report its open ports, vulnerabilities, and reputation level.