Security Scanner IP Ranges

One file, every security scanner

674 ranges from 6 providers in a single download. Permalinks — they always return the latest data, so you can curl them from a cron job.

# Block every security scanners range with iptables
wget -O security-scanners.txt https://cloud-ip-ranges.com/download/category/security-scanners.txt
while read ip; do iptables -A INPUT -s $ip -j DROP; done < security-scanners.txt

How this list is used

This is the traffic that fills a firewall log with connections nobody asked for. Tagging it stops a routine scan from reading as a targeted attack, and keeps your alerting for things that are not simply the whole internet being indexed. Blocking is optional and mostly cosmetic — the scan happens either way, and a service that is exposed is exposed whether or not one crawler can see it. Treat a hit as a prompt to check what that port is doing open. Several of these operators publish no ranges at all, so their lists are observed addresses and lag a rotation.