List of IPs belonging to common internet-wide scanning organizations.
The data is provided in the following formats:
- nftables
- cidr If you would like the data in a format not listed above, open an issue.
List currently contains data for the following organizations:
- 360 Quake (quake.360.net)
- A10 Networks (a10protects.com/a10networks.com)
- Academy for Internet Research (academyforinternetresearch.org)
- Adscore (adscore.com)
- Alpha Strike Labs (alphastrike.io)
- BinaryEdge (binaryedge.io/binaryedge.ninja)
- BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org)
- bufferover.run / erbbysam (bufferover.run)
- Censys (censys.io/censys.com/censys-scanner.com)
- Criminal IP (criminalip.com)
- CrowdStrike Falcon Surface (crowdstrike.com)
- CyberCube (cybcube.com)
- CyberGreen Institute (cybergreen.net)
- CyberResilience (cyberresilience.io)
- Cyble ODIN (odin.io)
- Cypex (cypex.ai)
- Dataplane.org (dataplane.org)
- Driftnet (driftnet.io/internet-measurement.com)
- ESET Research (eset.com)
- FOFA Search Engine (fofa.info)
- Group-IB (rnd.group-ib.com)
- Hadrian (hdrn.nu / hadrian.io)
- Hunter Search Engine (hunter.how / hunter.qianxin.com)
- Internet Metrics (internet-metrics.com)
- Internet Research Project (internet-research-project.net)
- InterneTTL (internettl.org)
- Intrinsec (intrinsec.com)
- IPinfo Internet Census Data Collection (ipinfo.io)
- IPIP (ipip.net)
- KI3 (ki3.org.cn)
- Knoq (knoq.nl)
- LeakIX (leakix.org / leakix.net)
- Mandiant ASM / GTI (mandiant.com)
- Modat (modat.io)
- Netlas (netlas.io)
- NETSCOUT (internet-albedo.net)
- netsecscan.net
- Nokia Deepfield (deepfield.net)
- ONLYSCANS (onlyscans.com)
- ONYPHE (onyphe.io / onyphe.net)
- Palo Alto Networks / Cortex Xpanse (paloaltonetworks.com / xpanse.co)
- pocnroll (pocnroll.com)
- Rapid7 Project Sonar (rapid7.com)
- Recyber (recyber.net)
- Research Scanner (research-scanner.com)
- Scanopticon (scanopticon.com)
- securityresearch.net
- Shadowforce / Baffin Bay Networks Data Acquisition and Threat Research (shadowforce.io / baffinbay.com / baffinaybaynetworks.com)
- Shodan (shodan.io)
- Stretchoid (stretchoid.com)
- Tenable ASM (tenable.com / tenable.io)
- The Shadowserver Foundation (shadowserver.org)
- ZoomEye (zoomeye.ai)
The other file contains scanners that do not belong to any specific organization.
In addition, scanners from the following educational institutions are also included:
- Cambridge Cybercrime Centre
- Georgia Institute of Technology
- KU Leuven
- Louisiana State University
- Max Planck Institute for Informatics
- Paderborn University
- RWTH Aachen University
- Ruhr University Bochum
- Stanford University
- TUD Dresden University of Technology
- Technical University of Applied Sciences Augsburg
- Technical University of Denmark
- Technical University of Munich
- Tsinghua University
- USC/ISI
- University of Memphis
- University of Applied Sciences Muenster
- University of California
- University of Maryland
- University of Michigan
- University of Southern California
- University of Twente
- Virginia Tech