Shodan Attack Surface Mapper — Open Ports, Services, CVEs, Geolocation

Map the external attack surface of any IP address or domain using the Shodan API. Returns open ports, running services, service banners, known CVEs, geolocation, ASN, and ISP — all from a single Actor run.

Requires a free Shodan API key — register at shodan.io. The free tier supports direct IP lookups with no credit card required.

---

Use Cases

• Penetration testing recon — quickly enumerate open ports and services on targets before an engagement
• External attack surface management (EASM) — continuously monitor what your organization exposes to the internet
• Vendor / third-party risk assessment — audit a vendor's internet-facing infrastructure for misconfigurations
• Cloud misconfiguration detection — find inadvertently exposed RDP, SSH, database, or admin ports
• CVE triage — identify hosts running software with known CVEs before your security team does
• Research and threat intelligence — bulk-enrich IP lists with service, location, and vulnerability context

---

Input

Field	Type	Required	Description
shodanApiKey	string (secret)	Yes	Your Shodan API key. Get free at shodan.io
ips	array of string	No*	IPv4 or IPv6 addresses to look up
domains	array of string	No*	Domain names to resolve then look up
includeVulns	boolean	No	Include known CVE IDs (default: true)
includeBanners	boolean	No	Include raw service banners, first 200 chars (default: false)

* At least one IP or domain is required.

Example input (JSON)

{
  "shodanApiKey": "YOUR_SHODAN_API_KEY",
  "ips": ["8.8.8.8", "1.1.1.1"],
  "domains": ["scanme.nmap.org"],
  "includeVulns": true,
  "includeBanners": false
}

---

Output

Each scanned host produces one result item. A final _type: "summary" item aggregates the run.

Host result (found)

{
  "ip": "45.33.32.156",
  "found": true,
  "hostnames": ["scanme.nmap.org"],
  "domains": ["nmap.org"],
  "country_name": "United States",
  "city": "Fremont",
  "org": "Linode",
  "isp": "Linode, LLC",
  "asn": "AS63949",
  "open_ports": [22, 80, 9929, 31337],
  "port_count": 4,
  "services": [
    {
      "port": 22,
      "protocol": "ssh",
      "product": "OpenSSH",
      "version": "6.6.1p1",
      "cpe": ["cpe:/a:openbsd:openssh:6.6.1p1"],
      "transport": "tcp"
    },
    {
      "port": 80,
      "protocol": "http",
      "product": "Apache httpd",
      "version": "2.4.7",
      "cpe": ["cpe:/a:apache:http_server:2.4.7"],
      "transport": "tcp"
    }
  ],
  "vulns": ["CVE-2014-0160", "CVE-2015-3253"],
  "vuln_count": 2,
  "tags": [],
  "last_update": "2024-11-15T08:21:00.000000",
  "scanned_at": "2025-09-01T12:00:00.000000Z"
}

Host result (not found)

{
  "ip": "192.168.1.1",
  "found": false,
  "scanned_at": "2025-09-01T12:00:00.000000Z"
}

Summary item

{
  "_type": "summary",
  "total_hosts": 3,
  "hosts_found": 2,
  "hosts_not_found": 1,
  "total_open_ports": 12,
  "common_ports_breakdown": [
    {"port": 443, "count": 2},
    {"port": 80, "count": 2},
    {"port": 22, "count": 1}
  ],
  "hosts_with_vulns": 1,
  "unique_countries": ["Germany", "United States"],
  "completed_at": "2025-09-01T12:00:05.000000Z"
}

---

Pricing

Event	Price
Actor start	$0.001
Per IP/host scanned	$0.005

Scanning 100 hosts costs approximately $0.50 + compute time.

---

Comparison to Alternatives

Tool	Cost	What you get
Shodan Enterprise API	$899+/yr	Full search, real-time scans, alerts
Censys Enterprise	$15,000+/yr	Certificate transparency + Shodan-style scan
This Actor	$0.005/host	Shodan free-tier host lookups, structured output, Apify integration

This Actor is ideal for teams that need structured, enriched host data without a Shodan Enterprise subscription.

---

Free Tier Limitations

• No search queries — only direct IP lookups (/shodan/host/{ip})
• No real-time scanning — data reflects Shodan's last crawl of that IP
• Rate limited — 1 request/second; the Actor automatically throttles to comply
• No HTTPS certificate data or historical port data (paid features)

Upgrade path for paid Shodan accounts

If you have a Shodan paid plan (from $49/mo), you can also use Shodan's search API (/shodan/host/search) to find all hosts matching a query — e.g., all Apache servers in Germany with port 3389 open. Contact us or open a GitHub issue to request this extension.

---

Tips

• Use domains input to automatically resolve hostnames to IPs before scanning — useful when you know domain names but not IPs.
• Enable includeBanners only when you need raw service fingerprinting data — it can significantly increase output size.
• Combine with the Smart Money Wallet Tracker or other infrastructure actors for comprehensive recon workflows.
• Results are based on Shodan's last crawl — for fresh data you need a Shodan paid scan credit.

Keywords: Shodan, attack surface, port scanning, OSINT, security audit, CVE, SSL, network reconnaissance, cybersecurity

---

Related actors

• SSL Certificate Monitor — Certificate details and expiry monitoring for the exposed services found here
• CVE Vulnerability Tracker — CVE intelligence to research vulnerabilities flagged by this actor
• Domain Breach Checker — Data breach history for domains whose attack surface is mapped here

Feedback

If this actor powers your security research, a review helps others find it: Leave a review on Apify Store