'shodan' 검색 결과

Investigate domains, IP addresses, and certificates linked to suspected attackers using public sources. This skill guides passive research and relationship mapping to support phishing investigations, external exposure reviews, and threat intelligence reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating infrastructure linked to a phishing campaign
• Adding public evidence to threat actor profiles
• Reviewing an organization's external exposure

This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build a Python system that follows DNS history, domain registration records, and certificate information from known suspicious domains or IP addresses. Map related attack infrastructure, identify shared connections, and monitor for newly discovered domains matching known patterns.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding related domains from a known suspicious IP
• Mapping attacker command-and-control infrastructure
• Monitoring domains that match known naming patterns

Utilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build an OpenCTI pipeline that adds external context to indicators of compromise, such as suspicious IP addresses. Connect intelligence services, relate indicators to known attackers and campaigns, and score confidence to help analysts prioritize investigations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Deploying OpenCTI and configuring enrichment connectors
• Automatically adding context to suspicious IP addresses and domains
• Relating indicators to known attackers and campaigns

Shodan API reference. Host reconnaissance, port scanning, and vulnerability data.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build a central platform for collecting, analyzing, and sharing cyber threat information. Connect MISP, OpenCTI, TheHive, and Cortex to import feeds, add context to suspicious indicators, manage cases, and track platform activity.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a central threat intelligence platform
• Automate threat feed ingestion
• Add context to suspicious IP addresses and domains

Build threat actor profiles from public reports, social media, code repositories, and other intelligence sources. Correlates indicators, maps related infrastructure and attack techniques, and produces structured dossiers with confidence assessments about who may be responsible.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Consolidating public information about an attacker group
• Comparing aliases, targets, and motivations across sources
• Mapping related domains, IP addresses, and infrastructure

Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding threat context to security alerts
• Processing indicators from phishing email submissions
• Standardizing bulk indicator lookups from threat feeds

Find lookalike domains with dnstwist and prioritize suspicious results using DNS records, registration age, and website similarity. The skill also covers monitoring for new findings and producing blocklists and reports to support domain takedown requests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding domains that imitate a company or brand
• Investigating suspected phishing domains
• Monitoring for newly discovered lookalike domains

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Investigate organizations, domains, media locations, and cryptocurrency flows using open-source intelligence, or OSINT. The skill helps select relevant research tools, connect findings across sources, and preserve evidence with timestamps, screenshots, file hashes, and reproducible logs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping an organization's publicly exposed infrastructure
• Connecting public company records and social profiles
• Investigating image locations and video evidence

Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains -> owned netblocks/ASN -> live assets — with attribution discipline, not just DNS breadth. The org-first attribution pyramid (legal entity -> LEI/registration -> corporate family -> owned domains -> owned netblocks/ASN -> live assets). Corporate-identity resolution via the GLEIF LEI API (legal name -> LEI, exact-LEI direct-children expansion, downward-only depth-capped BFS, NEVER a name re-resolution), SEC-EDGAR full-text search + Exhibit-21 subsidiary entity names, OpenCorporates entity corroboration, Wikidata SPARQL corporate graph (P856/P355/P749/P1830). Domain attribution via reverse-WHOIS (WhoisXML preview-then-purchase quota guard, SecurityTrails associated-domains — both paid), crt.sh O= certificate-transparency organization pivot (keyless), infrastructure correlation (shared NS/MX/SaaS-TXT, netblock membership, reverse-DNS PTR), and the independent-evidence combiner (1-prod(1-w_i), rule of three, OwnerTier NONE/WEAK/MODERATE/STRONG/CONFIRMED) — discover-only `related:` candidates are NEVER auto-scanned. Netblock/ASN attribution via org-first RIR queries (ARIN Whois-RWS org-handle search, RIPE DB organisation + inverse-org search) that recover 'dark netblocks' with no DNS link to the seed, ASN discovery (RIPEstat + BGPView union), the HYPERSCALER-SCOPE GUARD (never attribute a whole AWS/GCP/Azure/Cloudflare announced range to a tenant — keep only the seed-containing block, tag shared_hosting_cdn), and org-identity-seeded internet-scan-index queries (Shodan/Censys/ZoomEye/FOFA/BinaryEdge org: filters + an always-on keyless crt.sh fallback). Promote-to-scan triage ranks forgotten discover-only netblocks by remote-access exposure (gateway-vendor/KEV/control-plane/datastore port scoring) into an operator queue. Attribution confidence rubric + anti-patterns (namesake grafting via GLEIF name re-resolution, single-signal ownership, hyperscaler over-attribution, privacy-WHOIS pivot poisoning, RIR org-name collisions). Passive/keyless-first OSINT only — every paid-key dependency is enrichment on top of a keyless core, never a hard requirement. Use when mapping an organization's full corporate-family internet footprint, resolving a legal entity to its LEI/subsidiaries, discovering domains/netblocks/ASNs an org owns beyond its one seed domain, auditing M&A/shadow-IT sprawl, or scoping an engagement that starts from a company NAME rather than a domain.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Censys search engine for internet-connected hosts, TLS certificates, and web properties. Use when: certificate transparency monitoring, finding hosts by certificate fingerprint, alternative to Shodan for TLS/SSL analysis, discovering hosts running specific services, or tracking infrastructure changes via cert issuance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

OSINT and reconnaissance automation skill for passive collection, pivoting, deduplication, and graph-based analysis using subfinder, amass, dnsx, chaos, crt.sh, github-dorks, waybackurls, gau, gitleaks, trufflehog, theHarvester, h8mail, holehe, sherlock, Shodan, Censys, FOFA, and Hunter. Use for asset discovery, exposure monitoring, and authorized reconnaissance only.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Threat intelligence fusion skill for collecting, normalizing, deduplicating, enriching, and operationalizing IOCs and TTPs from OTX, MISP, abuse.ch, VirusTotal, Shodan, GreyNoise, Censys, CISA KEV, NVD, vendor blogs, and internal telemetry. Use to build STIX/TAXII feeds, ATT&CK-mapped actor profiles, prioritized blocklists, and detection-ready intel packages.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when you need host reconnaissance for an IP or domain — open ports, services, banners, OS detection, vulnerabilities. For domains, resolves DNS first then queries the IP. Commonly invoked by /ip-investigation and /domain-investigation. Retrieval only.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.