Enrich an IP address with VirusTotal and Shodan
Build a reusable workflow that takes an IP address as input. Query VirusTotal for reputation/detections and Shodan for open ports, services, and known vulnerabilities. Merge into a single enrichment object. Validate the IP format, handle IPs not found in either source, respect rate limits, and retry failures. Output a combined reputation-and-exposure summary.
What this prompt builds
Look up an IP's reputation in VirusTotal and exposed services in Shodan in one step.
The problem
During an investigation analysts need both reputation and exposure context for an IP, but that means two separate lookups and manual correlation. The delay slows triage on every alert involving an IP.
Solution and impact
This workflow enriches an IP with VirusTotal reputation and Shodan exposure data and returns a combined picture. Analysts get reputation and open-port/service context together in seconds.