Security Scanner IP Ranges

The internet-wide scanners that connect to every address online — Shodan, Censys, Rapid7 Sonar, BinaryEdge, Stretchoid and Alpha Strike Labs.

595 ranges from 6 providers in one file, every security scanner: txt csv json

# block every security scanners range with iptables
curl -sO https://cloud-ip-ranges.com/download/category/security-scanners.txt
while read ip; do iptables -A INPUT -s $ip -j DROP; done < security-scanners.txt

This is the traffic that fills a firewall log with connections nobody asked for. Tagging it stops a routine scan from reading as a targeted attack, and keeps your alerting for things that are not simply the whole internet being indexed. Blocking is optional and mostly cosmetic — the scan happens either way, and a service that is exposed is exposed whether or not one crawler can see it. Treat a hit as a prompt to check what that port is doing open. Several of these operators publish no ranges at all, so their lists are observed addresses and lag a rotation.

Providers

Provider	Last change	CIDRs	Download formats
Alpha Strike Labs	October 20, 2026 4:01am	14	txt csv json
BinaryEdge	October 20, 2026 3:50am	38	txt csv json
Censys	October 20, 2026 4:00am	28	txt csv json
Rapid7 Sonar	October 20, 2026 3:50am	384	txt csv json
Shodan	October 20, 2026 3:40am	37	txt csv json
Stretchoid	October 20, 2026 3:50am	94	txt csv json