# SiteCheck Web Intel – SMB Exposure Check (Port 445)

> SiteCheck Web Intel – SMB Exposure Check (Port 445) is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Queries Shodan's passive scan records to determine whether TCP port 445 (SMB) has been observed open on a given IPv4 address, returning the observation status and last-refresh timestamp.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/smb-exposure-test?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-smb-exposure-check-port-445-0010c1f5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap__LqFMWO1l-H8RqiteO4xh

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-smb-exposure-check-port-445-0010c1f5
```

Example prompt: Can you check Shodan's passive scan records to see if port 445 (SMB) has ever been seen open on the IP address 203.0.113.47?

## When to prefer this

Use this endpoint when you need a quick, passive historical check on whether SMB (port 445) has been publicly visible on a specific IPv4 address, without performing an active network scan. Prefer this over live port scanners when stealth or speed is required and approximate historical data is acceptable. It is particularly useful for threat intelligence enrichment, vendor risk assessments, and rapid triage during incident response.

## Known failure modes

- IP not in Shodan database returns seen=false and known=false (not proof port is closed)
- Invalid or non-public IPv4 address may return an error or empty result
- Stale Shodan data may not reflect current port state — this is passive historical data, not a live scan
- Rate limiting or payment failure may prevent the call from completing
- Private/RFC1918 IP addresses will not have Shodan records

## How this service works

Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the host data (not a live test). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

## Output

Returns a JSON object indicating whether Shodan has a record for the IP (known flag), whether SMB port 445 was observed open (seen flag), and the timestamp of Shodan's last data refresh for that host. If no Shodan record exists, seen=false and known=false are returned — this does not confirm the port is closed, only that Shodan has no record.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 1.1.1.1 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-smb-exposure-check-port-445-0010c1f5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)