Public IP addresses should not be listed in Shodan
Azure Public IP addresses are detected as indexed by Shodan. This indicates Internet-visible services with open `ports` and service banner metadata. Prowler check `network_public_ip_shodan` flags these addresses.
Shodan-visible IPs are easy to discover and target, elevating risks to confidentiality and integrity. Adversaries can enumerate banners, probe open ports, brute-force access, and exploit known CVEs, enabling unauthorized entry, data exfiltration, and lateral movement.
What this control checks
Checks that public IP addresses are not listed in Shodan
Audit evidence
Evidence that deployed resources meet this control: Prowler check network_public_ip_shodan (prowler azure --checks network_public_ip_shodan).
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security) and A.8.21 (Security of Network Services).
NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 2.3.1 (The relevant entities shall review independently their approach to managing network and information system security and...), 6.7.2.b (determine and apply controls to protect the relevant entities internal network domains from unauthorised access;) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- A.8.20 Network security
- A.8.21 Security of network services
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 7.7 Ensure that Public IP addresses are Evaluated on a Periodic Basis
Related controls
- Virtual networks should have Azure DDoS Protection Standard enabled
- Storage accounts should have public network access disabled
- Kubernetes cluster nodes should prohibit public access
- Network security groups should limit inbound TCP port 25 access from the internet
- MySQL servers should have public network access disabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
azure_network_public_ip_shodan - Prowler Check:
network_public_ip_shodan
Last reviewed: 2026-10-11