I'm attempted to eliminate a lot of the malicious traffic on my webserver as possible. In doing so I have performed a few tests and found that when my server is not listed on shodan there are no port scans or any attempts to break in. But once shodan indexes the server and relists it again we are flood with attempts.

So to complete the project I need to block their scanning servers. Which netblocks and/or server addresses are they using?

(note: this is not how to defend against scans as suggested by a few moderators this is a legit question on which servers that shodan/@achillean actually uses for their scans)

  • It's quite likely that Shodan keeps their IP list secret to keep people from doing exactly what you're trying to do.
    – Mark
    Commented Jun 15, 2014 at 22:37
  • @Mark While that might be; So far the most related scans I have been able to coreliate all point to gandi.net being the CNC node to thier scanners. Commented Jun 16, 2014 at 3:49


Browse other questions tagged .