List of IPs belonging to common internet-wide scanning organizations.
The data is provided in the following formats:
- nftables
- cidr
List currently contains data for the following organizations:
- 360 Quake (quake.360.net)
- A10 Networks (a10protects.com / a10networks.com)
- Academy for Internet Research (academyforinternetresearch.org)
- Adscore (adscore.com)
- Alpha Strike Labs (alphastrike.io)
- BinaryEdge (binaryedge.io / binaryedge.ninja)
- BitSight Technologies Inc. / Internet Census Group (bitsight.com / internet-census.org)
- bufferover.run / erbbysam (bufferover.run)
- Censys (censys.io / censys.com / censys-scanner.com)
- Criminal IP / AiSpera (criminalip.com / aispera.com)
- CrowdStrike Falcon Surface (crowdstrike.com)
- CyberCube (cybcube.com)
- CyberGreen Institute (cybergreen.net)
- CyberOK (cyberok.ru)
- CyberResilience (cyberresilience.io)
- Cyble ODIN (odin.io)
- Cypex (cypex.ai)
- Dataplane.org (dataplane.org)
- Detectify (detectify.com)
- Driftnet (driftnet.io / internet-measurement.com, previously cyber.casa)
- Edgewatch Security Intelligence (edgewatch.com)
- ESET Research (eset.com)
- FOFA Search Engine (fofa.info)
- Group-IB (rnd.group-ib.com)
- Hacker Target Pty Ltd (hackertarget.com / hackertarget.io)
- Hadrian (hdrn.nu / hadrian.io)
- Hunter Search Engine (hunter.how / hunter.qianxin.com)
- Internet Metrics (internet-metrics.com)
- Internet Research Project (internet-research-project.net)
- InterneTTL (internettl.org)
- Intrinsec (intrinsec.com)
- Intruder (intruder.io)
- IPinfo Internet Census Data Collection (ipinfo.io)
- IPIP (ipip.net)
- KI3 (ki3.org.cn)
- Knoq (knoq.nl)
- LeakIX (leakix.org / leakix.net)
- Mandiant ASM / GTI (mandiant.com)
- Modat (modat.io)
- Netlas (netlas.io)
- NETSCOUT (internet-albedo.net)
- Nokia Deepfield (deepfield.net)
- ONLYSCANS (onlyscans.com)
- ONYPHE (onyphe.io / onyphe.net)
- Palo Alto Networks / Cortex Xpanse (paloaltonetworks.com / xpanse.co)
- pocnroll (pocnroll.com)
- ProbeTheNet Project / mThreat Technology Inc. (probethenet.com)
- Rapid7 Project Sonar (rapid7.com)
- Recorded Future / SecurityTrails (securitytrails.com)
- Recyber (recyber.net)
- Research Scanner (research-scanner.com)
- Root Evidence (rootevidence.com)
- securityresearch.net
- Shadowforce / Baffin Bay Networks Data Acquisition and Threat Research (shadowforce.io / baffinbay.com / baffinaybaynetworks.com)
- Shodan (shodan.io)
- Stretchoid (stretchoid.com)
- Tenable ASM (tenable.com / tenable.io)
- The Shadowserver Foundation (shadowserver.org)
- VisionHeight (visionheight.com)
- XMCO Serenety (xmco.fr)
- ZERN (zern.io)
- ZoomEye (zoomeye.ai)
The following scanning projects appear to have become defunct since they were initially tracked in this repository, the latest data snapshot from when they were still considered active is kept in the inactive folder for archival purposes:
- HSPO (hspo.io)
- netsecscan.net
- Scanopticon (scanopticon.com)
The other file contains scanners that do not belong to any specific organization.
In addition, scanners from the following educational institutions are also included:
- Cambridge Cybercrime Centre
- Esslingen University
- Georgia Institute of Technology
- Hasso Plattner Institute
- KU Leuven
- Louisiana State University
- Max Planck Institute for Informatics
- Paderborn University
- Polytechnic University of Milan
- Ruhr University Bochum
- RWTH Aachen University
- Stanford University
- Technical University of Applied Sciences Augsburg
- Technical University of Denmark
- Technical University of Munich
- Tsinghua University
- TUD Dresden University of Technology
- University of Applied Sciences Muenster
- University of California
- University of Maryland
- University of Memphis
- University of Michigan
- University of Southern California
- University of Twente
- University of Vienna
- USC/ISI
- Virginia Tech