# SiteCheck Web Intel SSH Banner Audit

> SiteCheck Web Intel SSH Banner Audit is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-25).

Looks up the SSH banner (OpenSSH version) and whether port 22 is open for a given IPv4 address, using public internet scan data.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/ssh-banner-audit?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-25
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-ssh-banner-audit-621ab688
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_l9_Kb6GRyur7CWKJONUuS

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-ssh-banner-audit-621ab688
```

Example prompt: Can you check whether the IP 185.220.100.240 has SSH port 22 open and tell me what OpenSSH version it's running?

## When to prefer this

Choose this endpoint when you need a quick, no-signup lookup of SSH banner and port-22 exposure for a specific IPv4 using public internet scan data. It is ideal for threat triage, incident response enrichment, or infrastructure auditing where you need SSH version info without running an active scan yourself. Prefer this over active port scanning tools when passively sourced data is sufficient and you want instant results at low cost.

## Known failure modes

- IP not found in scan data — 'known' field returns false and SSH fields may be absent
- Invalid or non-IPv4 address input returns a validation error
- Rate limiting or payment failure results in no charge and no data returned
- Scan data may be stale if the IP hasn't been recently re-scanned by Shodan

## How this service works

From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) list. This is passive and may be days old; it is not a live SSH banner grab or algorithm audit.

## Output

Returns a JSON object containing the queried IP, a boolean indicating if it is known in public scan data, the OpenSSH version string (e.g. '10.0p2'), whether SSH port 22 was seen open, the source URL (Shodan InternetDB), and the timestamp of the check.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 185.220.100.240 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ip": "185.220.100.240",
  "known": true,
  "source": "https://internetdb.shodan.io/185.220.100.240",
  "checkedAt": "2026-10-23T09:38:35.886Z",
  "opensshVersion": "10.0p2",
  "sshPortSeenOpen": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-ssh-banner-audit-621ab688/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)