Check ID: network_public_ip_shodan
Provider: Azure
Service: network
Severity: HIGH
Categories: internet-exposed
Resource type: microsoft.network/publicipaddresses

What this check verifies

Azure Public IP addresses are detected as indexed by Shodan, indicating Internet-visible services with open ports and service banner metadata.

Risk

Shodan-visible IPs are easy to discover and target, elevating risks to confidentiality and integrity. Adversaries can enumerate banners, probe open ports, brute-force access, and exploit known CVEs, enabling unauthorized entry, data exfiltration, and lateral movement.

Recommendation

Minimize public exposure: prefer private endpoints or VPN/bastion, restrict ingress per least privilege (avoid 0.0.0.0/0), close unused ports, patch and harden services, and apply defense-in-depth segmentation. Continuously inventory public IPs and rotate them if sensitive banners were exposed.

Remediation

az network public-ip delete —resource-group <RESOURCE_GROUP> —name <PUBLIC_IP_NAME>

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = network_public_ip_shodan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks