Download current IP ranges (CIDRs) used by the Rapid7 Sonar scanner.
Choose your preferred format. All downloads are permalinks that always provide the latest data.
First 25 of 384 ranges. Download the full list above, or search for a specific IP.
| CIDR | Type | Tag |
|---|---|---|
| 5.63.151.96/32 | ipv4 | rapid7sonar |
| 5.63.151.97/32 | ipv4 | rapid7sonar |
| 5.63.151.98/32 | ipv4 | rapid7sonar |
| 5.63.151.99/32 | ipv4 | rapid7sonar |
| 5.63.151.100/32 | ipv4 | rapid7sonar |
| 5.63.151.101/32 | ipv4 | rapid7sonar |
| 5.63.151.102/32 | ipv4 | rapid7sonar |
| 5.63.151.103/32 | ipv4 | rapid7sonar |
| 5.63.151.104/32 | ipv4 | rapid7sonar |
| 5.63.151.105/32 | ipv4 | rapid7sonar |
| 5.63.151.106/32 | ipv4 | rapid7sonar |
| 5.63.151.107/32 | ipv4 | rapid7sonar |
| 5.63.151.108/32 | ipv4 | rapid7sonar |
| 5.63.151.109/32 | ipv4 | rapid7sonar |
| 5.63.151.110/32 | ipv4 | rapid7sonar |
| 5.63.151.111/32 | ipv4 | rapid7sonar |
| 5.63.151.112/32 | ipv4 | rapid7sonar |
| 5.63.151.113/32 | ipv4 | rapid7sonar |
| 5.63.151.114/32 | ipv4 | rapid7sonar |
| 5.63.151.115/32 | ipv4 | rapid7sonar |
| 5.63.151.116/32 | ipv4 | rapid7sonar |
| 5.63.151.117/32 | ipv4 | rapid7sonar |
| 5.63.151.118/32 | ipv4 | rapid7sonar |
| 5.63.151.119/32 | ipv4 | rapid7sonar |
| 5.63.151.120/32 | ipv4 | rapid7sonar |
# Download with curl
curl -O https://cloud-ip-ranges.com/download/rapid7-sonar.txt
# Or download with wget
wget https://cloud-ip-ranges.com/download/rapid7-sonar.txt
# Download and block Rapid7 Sonar IPs with iptables
wget -O rapid7-sonar_ips.txt https://cloud-ip-ranges.com/download/rapid7-sonar.txt
while read ip; do
iptables -A INPUT -s $ip -j DROP
iptables -A OUTPUT -d $ip -j DROP
done < rapid7-sonar_ips.txt
# Download and block Rapid7 Sonar IPs with UFW
wget -O rapid7-sonar_ips.txt https://cloud-ip-ranges.com/download/rapid7-sonar.txt
while read ip; do
ufw deny from $ip
ufw deny to $ip
done < rapid7-sonar_ips.txt
# Create fail2ban filter for Rapid7 Sonar
sudo tee /etc/fail2ban/filter.d/rapid7-sonar-block.conf << EOF
[Definition]
failregex = ^.*$
ignoreregex =
EOF
# Create jail configuration
sudo tee /etc/fail2ban/jail.d/rapid7-sonar-block.conf << EOF
[rapid7-sonar-block]
enabled = true
filter = rapid7-sonar-block
action = iptables-allports[name=rapid7-sonar]
logpath = /tmp/rapid7-sonar_ips.txt
findtime = 1
bantime = -1
maxretry = 1
EOF
# Download IP list and restart fail2ban
wget -O /tmp/rapid7-sonar_ips.txt https://cloud-ip-ranges.com/download/rapid7-sonar.txt
sudo systemctl restart fail2ban
# Create alias table for Rapid7 Sonar IPs
# 1. Download the IP list
wget -O rapid7-sonar_ips.txt https://cloud-ip-ranges.com/download/rapid7-sonar.txt
# 2. In pfSense/OPNsense web interface:
# - Go to Firewall > Aliases
# - Create new alias named "RAPID7-SONAR_BLOCK"
# - Type: Network(s)
# - Import the downloaded file
#
# 3. Create firewall rule:
# - Go to Firewall > Rules > WAN
# - Add rule: Action=Block, Source=RAPID7-SONAR_BLOCK
These are the addresses Rapid7 Sonar scans the internet from, updated regularly. Use them to tag background scanning in your firewall and IDS logs so it does not read as a targeted attack, or to block the scanner outright if you would rather not be indexed. Last update was 26 minutes ago.