misp-warninglists/lists/shodan-nt-scanning/list.json at master · elhoim/misp-warninglists · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
{
  "description": "List containing IP's associated with the Shodan scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/08/10",
  "list": [
    "2.59.22.234/32",
    "66.240.192.138/32",
    "66.240.205.34/32",
    "66.240.219.146/32",
    "66.240.236.119/32",
    "71.6.135.131/32",
    "71.6.146.130/32",
    "71.6.146.185/32",
    "71.6.146.186/32",
    "71.6.147.254/32",
    "71.6.158.166/32",
    "71.6.165.200/32",
    "71.6.167.142/32",
    "71.6.199.23/32",
    "80.82.77.139/32",
    "80.82.77.33/32",
    "86.54.31.32/32",
    "86.54.31.34/32",
    "86.54.31.36/32",
    "86.54.31.38/32",
    "86.54.31.40/32",
    "86.54.31.42/32",
    "86.54.31.44/32",
    "86.54.31.46/32",
    "89.248.167.131/32",
    "89.248.172.16/32",
    "93.174.95.106/32",
    "94.102.49.193/32"
  ],
  "matching_attributes": [
    "ip-src",
    "ip-dst",
    "domain|ip",
    "ip-dst|port",
    "ip-src|port"
  ],
  "name": "Shodan IP Ranges Used for Scanning",
  "type": "cidr",
  "version": 26081010
}