Public IP addresses should not be listed in Shodan
Compute Engine public IP addresses are cross-checked with Shodan to identify Internet-exposed hosts that have been indexed, including observed open ports and metadata. Only EXTERNAL addresses are evaluated.
Being listed in Shodan indicates an Internet-reachable host with identifiable services. Adversaries can quickly enumerate ports, run brute-force or exploit scans, and weaponize misconfigurations, leading to data exposure (C), service tampering (I), and outages from abuse or DDoS (A).
What this control checks
Compute Engine EXTERNAL public IP addresses must not be listed in Shodan.
Common pitfalls
Only EXTERNAL addresses are evaluated
Only EXTERNAL addresses are evaluated.
Audit evidence
Evidence that deployed resources meet this control: Prowler check compute_public_address_shodan (prowler gcp --checks compute_public_address_shodan).
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- COS-02.01B Specific security requirements are designed, published and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility: - In which cases the security zones are to be...
- OIS-08.02B The following aspects are taken into account when identifying risks, insofar as they are applicable to the cloud service provided and are within the area of responsibility of the cloud service provider: - Processing, storage or transmission of cloud service customer data and cloud...
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_compute_public_address_shodan - Prowler Check:
compute_public_address_shodan
Last reviewed: 2026-10-09