Shodan Lookup.
/lookup-shodan
The Shodan lookup skill runs host reconnaissance from inside your AI coding agent: give it an IP or domain and it returns the open ports, running services, banners, geolocation and ASN that Shodan has on record. For a domain it resolves DNS first, then queries the resulting address, so you can fingerprint an attacker's infrastructure or check your own exposure without opening the Shodan web interface.
What it does.
It wraps the Shodan API as a self-contained skill. Pass it an IP and it returns the host's open ports, the services and banners on each one, any vulnerabilities Shodan has tagged, the hosting location and the ASN. Pass it a domain and it resolves the name to an address first, then runs the same host lookup against the result.
When to use it.
Use it when you need to understand what a host actually exposes: profiling suspicious infrastructure during an investigation, mapping an adversary's server, or sanity-checking the footprint of an asset you own. It is a natural follow-up after a reputation lookup flags an IP, and the IP and domain investigation workflows in the pack call it as part of their reconnaissance step.
What you get back.
A readable summary of the host: the list of open ports with their services and banner snippets, OS and product fingerprints where Shodan has them, tagged vulnerabilities, the country and organisation, and the ASN. For domain queries it shows the resolved IP it used. If no Shodan key is set the skill notes the gap and returns rather than failing the run.
How it fits your workflow.
Reconnaissance turns a bare IP into a picture of infrastructure, which is what makes pivoting possible. Run this skill after a reputation check, then use the exposed services and banners as pivot points: shared certificates, distinctive ports or matching banners often lead to related hosts. Feed the findings into your enrichment record or hand them to the indicator-pivoting workflow.
Frequently Asked Questions.
Ready to do more with less?
Request a demo or start your free trial today. Get instant access to AI-powered threat intelligence tailored to your organisation.