Check ID: compute_public_address_shodan
Provider: GCP
Service: compute
Severity: MEDIUM
Categories: internet-exposed
Resource type: compute.googleapis.com/Address

​
What this check verifies

Compute Engine public IP addresses are cross-checked with Shodan to identify Internet-exposed hosts that have been indexed, including observed open ports and metadata. Only EXTERNAL addresses are evaluated.

​
Risk

Being listed in Shodan indicates an Internet-reachable host with identifiable services. Adversaries can quickly enumerate ports, run brute-force or exploit scans, and weaponize misconfigurations, leading to data exposure (C), service tampering (I), and outages from abuse or DDoS (A).

​
Recommendation

Minimize Internet exposure:
  • Remove unused public IPs; prefer private addressing with controlled egress
  • Avoid 0.0.0.0/0; restrict by allowlists and firewall policies
  • Place services behind proxies/VPN/bastions; close unused ports
Apply least privilege and defense in depth; continuously monitor external footprint.

​
Remediation

gcloud compute addresses delete <example_resource_name> —region <REGION>

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_public_address_shodan. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks