Shodan IP ranges

Current IP ranges (CIDRs) used by the Shodan scanner, updated daily.

curl -O https://cloud-ip-ranges.com/download/shodan.txt

Blocking Shodan

iptables

curl -sO https://cloud-ip-ranges.com/download/shodan.txt
while read ip; do
  iptables -A INPUT -s $ip -j DROP
  iptables -A OUTPUT -d $ip -j DROP
done < shodan.txt

ufw

curl -sO https://cloud-ip-ranges.com/download/shodan.txt
while read ip; do
  ufw deny from $ip
  ufw deny to $ip
done < shodan.txt

fail2ban

sudo tee /etc/fail2ban/filter.d/shodan-block.conf << EOF
[Definition]
failregex = ^.*$
ignoreregex =
EOF

sudo tee /etc/fail2ban/jail.d/shodan-block.conf << EOF
[shodan-block]
enabled = true
filter = shodan-block
action = iptables-allports[name=shodan]
logpath = /tmp/shodan.txt
findtime = 1
bantime = -1
maxretry = 1
EOF

curl -so /tmp/shodan.txt https://cloud-ip-ranges.com/download/shodan.txt
sudo systemctl restart fail2ban

pfSense / OPNsense

curl -sO https://cloud-ip-ranges.com/download/shodan.txt
# Firewall > Aliases: new alias SHODAN_BLOCK, type Network(s), import the file
# Firewall > Rules > WAN: Action=Block, Source=SHODAN_BLOCK

About

These are the addresses Shodan scans the internet from, updated regularly. Use them to tag background scanning in your firewall and IDS logs so it does not read as a targeted attack, or to block the scanner outright if you would rather not be indexed. Last update was about 21 hours ago.

Other providers

AirVPN, Akamai, Alibaba, Alpha Strike Labs, Amazonbot, Amzn-SearchBot, Amzn-User, Anthropic, AppleBot, Atlassian, AWS, Azure, Backblaze, Baidu, BinaryEdge, BingBot, Bunny, CacheFly, CCBot, Censys, ChatGPT-User, ClaudeBot, Cloudflare, Datadog, DigitalOcean, DuckDuckBot, Fastly, Gabia, G-Core, GitHub, Googlebot, Google Cloud, Google Public DNS, Google Services, GPTBot, Hetzner, Hostway, Huawei Cloud, IBM Cloud, iCloud Private Relay, Internet Archive, IVPN, Leaseweb, Linode, Meta, Microsoft 365, Mistral, Mullvad, NHN Cloud, NordVPN, OpenAI ChatGPT, OpenAI SearchBot, Oracle Cloud, OVHcloud, OVPN.com, PerplexityBot, Perplexity-User, Pingdom, Private Internet Access, QUIC.cloud, Rackspace, Rapid7 Sonar, Salesforce, Scaleway, StatusCake, StormWall, Stretchoid, Sucuri, Telegram, Tencent, TOR, UpCloud, UptimeRobot, Vultr, Wasabi, Windscribe, Yandex, Zoho, Zoom, Zscaler