Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
network_public_ip_shodanProvider: Azure
Service:
networkSeverity: HIGH
Categories:
internet-exposedResource type:
microsoft.network/publicipaddressesWhat this check verifies
Azure Public IP addresses are detected as indexed by Shodan, indicating Internet-visible services with openports and service banner metadata.
Risk
Shodan-visible IPs are easy to discover and target, elevating risks to confidentiality and integrity. Adversaries can enumerate banners, probe open ports, brute-force access, and exploit known CVEs, enabling unauthorized entry, data exfiltration, and lateral movement.Recommendation
Minimize public exposure: prefer private endpoints or VPN/bastion, restrict ingress per least privilege (avoid0.0.0.0/0), close unused ports, patch and harden services, and apply defense-in-depth segmentation. Continuously inventory public IPs and rotate them if sensitive banners were exposed.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az network public-ip delete —resource-group <RESOURCE_GROUP> —name <PUBLIC_IP_NAME>
References
- https://www.shodan.io/
- https://support.icompaas.com/support/solutions/articles/62000235334-ensure-any-public-addresses-are-listed-in-shodan-using-shodan-api-
- https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = network_public_ip_shodan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks