Do I need a paid Shodan account?

A free Shodan API key works for basic host lookups. A paid membership unlocks higher query limits and some richer data fields, but you can run interactive reconnaissance on the free tier.

Can I look up a domain, or only an IP?

Both. Give it a domain and the skill resolves it to an IP through DNS first, then runs the host lookup against that address and tells you which IP it queried.

Does a Shodan lookup scan the target?

No. Shodan returns data from its own internet-wide scanning, so the skill only reads what Shodan already holds. It does not send any traffic to the host you are looking up.

Shodan Lookup.

/lookup-shodan

The Shodan lookup skill runs host reconnaissance from inside your AI coding agent: give it an IP or domain and it returns the open ports, running services, banners, geolocation and ASN that Shodan has on record. For a domain it resolves DNS first, then queries the resulting address, so you can fingerprint an attacker's infrastructure or check your own exposure without opening the Shodan web interface.

Get the free pack on GitHub →Or join the free tier waitlist

What it does.

It wraps the Shodan API as a self-contained skill. Pass it an IP and it returns the host's open ports, the services and banners on each one, any vulnerabilities Shodan has tagged, the hosting location and the ASN. Pass it a domain and it resolves the name to an address first, then runs the same host lookup against the result.

When to use it.

Use it when you need to understand what a host actually exposes: profiling suspicious infrastructure during an investigation, mapping an adversary's server, or sanity-checking the footprint of an asset you own. It is a natural follow-up after a reputation lookup flags an IP, and the IP and domain investigation workflows in the pack call it as part of their reconnaissance step.

What you get back.

A readable summary of the host: the list of open ports with their services and banner snippets, OS and product fingerprints where Shodan has them, tagged vulnerabilities, the country and organisation, and the ASN. For domain queries it shows the resolved IP it used. If no Shodan key is set the skill notes the gap and returns rather than failing the run.

How it fits your workflow.

Reconnaissance turns a bare IP into a picture of infrastructure, which is what makes pivoting possible. Run this skill after a reputation check, then use the exposed services and banners as pivot points: shared certificates, distinctive ports or matching banners often lead to related hosts. Feed the findings into your enrichment record or hand them to the indicator-pivoting workflow.

Keep going.

Frequently Asked Questions.

Want to see this on your own organisation?

Request a demo or start your free trial today, and get straight to AI-powered threat intelligence built around your organisation.