Known Scanners
IP addresses performing systematic internet-wide port and service scanning. It includes research and commercial scanners (such as Censys or Shodan) as well as malicious reconnaissance. Most of this activity is background noise that every exposed asset receives, so the feed is mainly intended to tag, deprioritize or suppress these events in the SIEM, to filter scanning against exposed web applications, and optionally to drop inbound scanning at the perimeter firewall to reduce exposure. Apply it to inbound traffic only; it is not meant as a blocklist of malicious actors.
- Author
- davidgil
- Created
- 2026-11-03 14:28:37
- Last updated
- 2026-11-03 14:29:43
- Downloads
- 27
- IPv4 indicators
- 131017
Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.