Rapid7 Sonar IP ranges

Current IP ranges (CIDRs) used by the Rapid7 Sonar scanner, updated daily.

curl -O https://cloud-ip-ranges.com/download/rapid7-sonar.txt

Blocking Rapid7 Sonar

iptables

curl -sO https://cloud-ip-ranges.com/download/rapid7-sonar.txt
while read ip; do
  iptables -A INPUT -s $ip -j DROP
  iptables -A OUTPUT -d $ip -j DROP
done < rapid7-sonar.txt

ufw

curl -sO https://cloud-ip-ranges.com/download/rapid7-sonar.txt
while read ip; do
  ufw deny from $ip
  ufw deny to $ip
done < rapid7-sonar.txt

fail2ban

sudo tee /etc/fail2ban/filter.d/rapid7-sonar-block.conf << EOF
[Definition]
failregex = ^.*$
ignoreregex =
EOF

sudo tee /etc/fail2ban/jail.d/rapid7-sonar-block.conf << EOF
[rapid7-sonar-block]
enabled = true
filter = rapid7-sonar-block
action = iptables-allports[name=rapid7-sonar]
logpath = /tmp/rapid7-sonar.txt
findtime = 1
bantime = -1
maxretry = 1
EOF

curl -so /tmp/rapid7-sonar.txt https://cloud-ip-ranges.com/download/rapid7-sonar.txt
sudo systemctl restart fail2ban

pfSense / OPNsense

curl -sO https://cloud-ip-ranges.com/download/rapid7-sonar.txt
# Firewall > Aliases: new alias RAPID7-SONAR_BLOCK, type Network(s), import the file
# Firewall > Rules > WAN: Action=Block, Source=RAPID7-SONAR_BLOCK

About

These are the addresses Rapid7 Sonar scans the internet from, updated regularly. Use them to tag background scanning in your firewall and IDS logs so it does not read as a targeted attack, or to block the scanner outright if you would rather not be indexed. Last update was about 21 hours ago.

Other providers

AirVPN, Akamai, Alibaba, Alpha Strike Labs, Amazonbot, Amzn-SearchBot, Amzn-User, Anthropic, AppleBot, Atlassian, AWS, Azure, Backblaze, Baidu, BinaryEdge, BingBot, Bunny, CacheFly, CCBot, Censys, ChatGPT-User, ClaudeBot, Cloudflare, Datadog, DigitalOcean, DuckDuckBot, Fastly, Gabia, G-Core, GitHub, Googlebot, Google Cloud, Google Public DNS, Google Services, GPTBot, Hetzner, Hostway, Huawei Cloud, IBM Cloud, iCloud Private Relay, Internet Archive, IVPN, Leaseweb, Linode, Meta, Microsoft 365, Mistral, Mullvad, NHN Cloud, NordVPN, OpenAI ChatGPT, OpenAI SearchBot, Oracle Cloud, OVHcloud, OVPN.com, PerplexityBot, Perplexity-User, Pingdom, Private Internet Access, QUIC.cloud, Rackspace, Salesforce, Scaleway, Shodan, StatusCake, StormWall, Stretchoid, Sucuri, Telegram, Tencent, TOR, UpCloud, UptimeRobot, Vultr, Wasabi, Windscribe, Yandex, Zoho, Zoom, Zscaler