IP Threat Intelligence & Open Ports Scraper

Find out what the internet already knows about any IP address — open ports, known CVEs, hostnames, tags and CPEs — plus full ASN and geolocation context. No API key, no scanning, no setup.

Feed the actor a list of IP addresses or a list of domains. For domains it resolves the A records first, then looks up every resulting IP. You get one clean row per host, ready for a spreadsheet, a SIEM, or your asset inventory.

---

⚠️ This is passive data — nothing is scanned

This actor does not scan, probe, connect to, or touch the target hosts in any way. It reads a pre-computed public index (Shodan InternetDB) that has already been collected and published, and merges it with public WHOIS/RDAP-derived ASN data. Every request goes to the index APIs, never to your targets.

That makes it safe to run against third-party infrastructure, vendors, and acquisition targets without triggering IDS alerts, rate limits, or abuse complaints — and without the legal grey area of active port scanning. It also means the data reflects the index's last crawl, not this second.

---

How this differs from my other IP actors

I publish three IP-related actors. They answer three different questions:

Actor	Question it answers	Typical fields
ip-threat-intel-scraper (this one)	"How exposed is this host?" — security posture	open ports, CVE list, tags, CPEs, hostnames, risk level
ip-geolocation-scraper	"Where is this IP and who runs it?" — location & network identity	country, city, coordinates, ISP, timezone, currency
ripestat-scraper	"How is this prefix routed?" — BGP & registry data	announced prefixes, BGP routing status, RIR allocation, abuse contacts

Short version: geolocation tells you where, RIPEstat tells you how it's routed, this one tells you what's exposed. This actor includes a slim geo/ASN enrichment layer so you don't have to run two actors for a basic report — but if you need deep location or deep routing data, use the dedicated actors above.

---

Use cases

Attack surface monitoring

Schedule a daily run over your own IP ranges and public domains. Get alerted the moment a new port appears or a fresh CVE gets attached to a host you own. Because the data is passive, you can monitor continuously without generating any traffic against production.

Security audits

Auditing a client, a vendor, or an acquisition target? Drop in their domains, get back a per-host exposure table with CVE counts and a risk level in seconds. Perfect as the reconnaissance appendix in a pentest report or a third-party risk questionnaire.

Asset inventory

Shadow IT is the hard part of asset management. Resolve every domain you own, scan the resulting IPs, and compare the discovered hostnames and open ports against your CMDB. The hostnames field frequently surfaces forgotten subdomains and legacy load balancers.

Threat hunting

Enrich IOCs from your logs. Feed a list of suspicious IPs and instantly see which ones are running exposed databases, have tags like honeypot, vpn or cloud, or carry known CVEs — plus the ASN and org that owns them, so you know who to contact.

---

Input

Field	Type	Default	Description
mode	select	ips	ips scans the IP list directly. domains resolves A records first, then scans each IP.
ips	array	["8.8.8.8","1.1.1.1"]	IPv4/IPv6 addresses, one per line. Used in ips mode.
domains	array	–	Domains such as example.com. Used in domains mode. Schemes, paths and www. are stripped for you.
enrichGeo	boolean	true	Add ASN, org, ISP, country, city, coordinates and timezone. Turn off for a faster ports-only run.
maxItems	integer	100	Hard cap on hosts scanned per run (max 1000).

{
  "mode": "domains",
  "domains": ["github.com", "example.com"],
  "enrichGeo": true,
  "maxItems": 100
}

Output

One item per host. Every field is nullable, so downstream parsers never break.

{
  "ip": "140.82.121.3",
  "query": "github.com",
  "found": true,
  "open_ports": [22, 80, 443],
  "port_count": 3,
  "vulns": [],
  "vuln_count": 0,
  "has_vulns": false,
  "hostnames": ["lb-140-82-121-3-fra.github.com"],
  "tags": [],
  "cpes": [],
  "risk_level": "low",
  "asn": 36459,
  "asn_org": "Github, Inc.",
  "isp": "Github, Inc.",
  "org_domain": "github.com",
  "country": "Germany",
  "country_code": "DE",
  "region": "Hessen",
  "city": "Frankfurt am Main",
  "latitude": 50.110859,
  "longitude": 8.6821259,
  "is_eu": true,
  "timezone": "Europe/Berlin",
  "source": "shodan-internetdb+ipwhois",
  "scraped_at": "2026-07-28T14:34:59Z"
}

Field notes

• query keeps whatever you originally supplied. In domains mode this is the domain, so you can group multiple A records back to their hostname.
• found is false when the index has no record for that IP. The row is still emitted — that way you can tell "clean/unknown" apart from "never checked". This is the single most useful field for diffing runs.
• risk_level is a simple, transparent heuristic: high if vuln_count > 0, else medium if port_count > 5, else low. Use it for triage and sorting, not as a verdict.
• vulns contains CVE identifiers, uppercased and deduplicated. Cross-reference them against NVD for severity scores.
• cpes is capped at 20 entries per host to keep rows compact.

Pricing

Roughly $1 per 1,000 hosts. Both upstream data sources are free and key-less, so you are only paying Apify compute. The actor runs on 512 MB and paces itself at about one host per second to respect the index's rate limits — budget ~1 minute per 50 hosts.

Related actors

• IP Geolocation Scraper — deep location, ISP, currency and timezone data per IP
• RIPEstat Scraper — BGP routing, announced prefixes and RIR registry data
• SSL Certificate Checker — certificate chain, issuer, expiry and SAN list per domain
• Domain Intel Scraper — WHOIS, DNS records and registrar intelligence per domain

Legal & fair use

All data comes from publicly published indexes and public registry information. No authentication is bypassed and no host is contacted. You are still responsible for using the output lawfully — this is a reconnaissance and defensive-monitoring tool, not permission to attack anything.