This question already has an answer here:

I'm attempted to eliminate a lot of the malicious traffic on my webserver as possible. In doing so I have performed a few tests and found that when my server is not listed on shodan there are no port scans or any attempts to break in. But once shodan indexes the server and relists it again we are flood with attempts.

So to complete the project I need to block their scanning servers. Which netblocks and/or server addresses are they using?

(note: this is not how to defend against scans as suggested by a few moderators this is a legit question on which servers that shodan/@achillean actually uses for their scans)

marked as duplicate by Lucas Kauffman, Mark, Xander, Thomas Pornin, TildalWave Jun 15 '14 at 17:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • It's quite likely that Shodan keeps their IP list secret to keep people from doing exactly what you're trying to do. – Mark Jun 15 '14 at 22:37
  • @Mark While that might be; So far the most related scans I have been able to coreliate all point to gandi.net being the CNC node to thier scanners. – Dwight Spencer Jun 16 '14 at 3:49

Browse other questions tagged or ask your own question.