Public IP address is not listed in Shodan

compute_public_address_shodan

Service: computeSeverity: medium

OfficialBuilt-inVerified

Categories:internet-exposed

Resource Type:compute.googleapis.com/Address

Compute Engine public IP addresses are cross-checked with Shodan to identify Internet-exposed hosts that have been indexed, including observed open ports and metadata.

Only EXTERNAL addresses are evaluated.

Prowler prowler-provider-gcp

Risk

Being listed in Shodan indicates an Internet-reachable host with identifiable services. Adversaries can quickly enumerate ports, run brute-force or exploit scans, and weaponize misconfigurations, leading to data exposure (C), service tampering (I), and outages from abuse or DDoS (A).

Run this check with Prowler

Run in Prowler Cloud

Run

prowler gcp --checks compute_public_address_shodan

Recommendation

Minimize Internet exposure:

Remove unused public IPs; prefer private addressing with controlled egress
Avoid 0.0.0.0/0; restrict by allowlists and firewall policies
Place services behind proxies/VPN/bastions; close unused ports

Apply least privilege and defense in depth; continuously monitor external footprint.

Remediation

CLI

gcloud compute addresses delete <example_resource_name> --region <REGION>

Terraform

# Reserve an internal address instead of a public one
resource "google_compute_address" "<example_resource_name>" {
  name         = "<example_resource_name>"
  region       = "<REGION>"
  subnetwork   = "<example_subnetwork_name>"
  address_type = "INTERNAL" # FIX: use INTERNAL to avoid a public (EXTERNAL) IP listed by Shodan
}

Other

1In the Google Cloud Console, go to: VPC network > IP addresses > External

2Find the public IP shown in the finding

3If it is attached to a VM: go to the VM > Edit > Network interfaces > set External IP to None > Save

4Return to External IP addresses and click Release to delete the public IP

Check Code

import shodan

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.lib.logger import logger
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_public_address_shodan(Check):
    def execute(self):
        findings = []
        shodan_api_key = compute_client.audit_config.get("shodan_api_key")
        if shodan_api_key:
            api = shodan.Shodan(shodan_api_key)
            for address in compute_client.addresses:
                if address.type == "EXTERNAL":
                    report = Check_Report_GCP(
                        metadata=self.metadata(), resource=address
                    )
                    try:
                        shodan_info = api.host(address.ip)
                        report.status = "FAIL"
                        report.status_extended = f"Public Address {address.ip} listed in Shodan with open ports {str(shodan_info['ports'])} and ISP {shodan_info['isp']} in {shodan_info['country_name']}. More info at https://www.shodan.io/host/{address.ip}."
                        findings.append(report)
                    except shodan.APIError as error:
                        if "No information available for that IP" in error.value:
                            report.status = "PASS"
                            report.status_extended = (
                                f"Public Address {address.ip} is not listed in Shodan."
                            )
                            findings.append(report)
                            continue
                        else:
                            logger.error(f"Unknown Shodan API Error: {error.value}")

        else:
            logger.error(
                "No Shodan API Key -- Please input a Shodan API Key with -N/--shodan or in config.yaml"
            )
        return findings