# SiteCheck Web Intel – Open Port Scanner (Shodan Passive)

> SiteCheck Web Intel – Open Port Scanner (Shodan Passive) is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Returns the list of TCP ports Shodan has passively observed open on a given IPv4 address, using pre-collected scan data (not a live scan).

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/open-port-scanner?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-open-port-scanner-shodan-passive-b0fe9af1
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_KhKo-R2CO8PbmHTESCiXk

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-open-port-scanner-shodan-passive-b0fe9af1
```

Example prompt: What TCP ports does Shodan's passive scan data show as open on 198.51.100.42? I don't need a live scan, just whatever Shodan already has recorded.

## When to prefer this

Use this endpoint when you need a quick, non-intrusive lookup of what TCP ports have historically been visible on an IPv4 address, without triggering a live scan. Ideal for threat intelligence triage, attack surface auditing, and vendor risk assessments where passive data is sufficient. Prefer this over live scanning tools when stealth, speed, or avoiding active connection probing is important. Not suitable when you need real-time accuracy or when the IP has no Shodan record.

## Known failure modes

- IP not in Shodan's database returns known=false with no port list
- Invalid or non-public IPv4 address may return an error or empty response
- Stale data: ports shown as open may have since been closed
- IPv6 addresses are not supported
- Rate limiting or payment failure returns an HTTP error

## How this service works

Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). The record can be days old, and an address with no record returns known=false, which does not prove the ports are closed.

## Output

Returns a list of TCP port numbers Shodan has previously observed open on the given IPv4 address, along with a 'known' boolean indicating whether Shodan has any record for that address at all. If known=false, no scan data exists for that IP (which does not confirm the ports are closed). The data may be days old and reflects passive collection, not a live connection attempt.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 1.1.1.1 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-open-port-scanner-shodan-passive-b0fe9af1/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)