{
  "meta": {
    "description": "Known scanner and internet-wide survey tool IP ranges, compiled from live honeypot data at 22div.com.au",
    "source": "22nd Survey Division — security-tools/scanner-fucker honeypot",
    "updated": "2026-09",
    "license": "CC0 1.0 Universal — no rights reserved",
    "note": "Ranges are updated periodically from honeypot observations and public disclosure. Use for firewall blocklisting, IDS tuning, or threat intelligence enrichment."
  },
  "scanners": [
    {
      "name": "Shodan",
      "description": "Internet-wide scan engine operated by Shodan.io",
      "detection": "IP range + service-specific payload signatures",
      "ranges": [
        "66.240.192.0/24",
        "66.240.219.0/24",
        "71.6.135.0/24",
        "71.6.165.0/24",
        "71.6.167.0/24",
        "71.6.199.0/24",
        "80.82.77.0/24",
        "93.120.27.0/24",
        "188.138.9.0/24",
        "198.20.69.0/24",
        "198.20.70.0/24",
        "198.20.99.0/24",
        "198.20.100.0/24",
        "198.20.101.0/24"
      ]
    },
    {
      "name": "Censys",
      "description": "Research-oriented internet census platform operated by Censys Inc.",
      "detection": "IP range + 'Censys' string in payload / User-Agent",
      "ranges": [
        "162.142.125.0/24",
        "167.94.138.0/24",
        "167.94.145.0/24",
        "167.94.146.0/24",
        "167.248.133.0/24",
        "206.168.34.0/24"
      ]
    },
    {
      "name": "BinaryEdge",
      "description": "Cyber threat intelligence platform performing continuous internet mapping",
      "detection": "IP range",
      "ranges": [
        "37.19.221.0/24",
        "143.42.56.0/24",
        "185.142.236.0/24"
      ]
    },
    {
      "name": "Shadowserver",
      "description": "Non-profit security organisation conducting internet-wide scanning for research and abuse mitigation",
      "detection": "IP range",
      "ranges": [
        "74.82.47.0/24",
        "184.105.139.0/24",
        "184.105.143.0/24",
        "184.105.247.0/24",
        "216.218.206.0/24",
        "216.218.208.0/24"
      ]
    },
    {
      "name": "Stretchoid",
      "description": "Automated scanner identified by MGLNDD payload signature",
      "detection": "Payload string 'MGLNDD'",
      "ranges": [
        "198.96.95.0/24"
      ]
    },
    {
      "name": "Infrawatch",
      "description": "Infrastructure monitoring and reconnaissance service",
      "detection": "IP range",
      "ranges": [
        "5.226.140.0/24",
        "69.5.169.0/24",
        "104.130.64.0/24",
        "119.31.143.0/24",
        "148.251.113.0/24",
        "193.27.228.0/24"
      ]
    },
    {
      "name": "Palo Alto Networks",
      "description": "Security vendor scanning for research and threat intelligence",
      "detection": "IP range",
      "ranges": [
        "198.235.24.0/24"
      ]
    },
    {
      "name": "InternetDB / HackerTarget",
      "description": "OSINT aggregators and passive reconnaissance services",
      "detection": "IP range",
      "ranges": [
        "202.0.96.0/24",
        "66.220.230.0/24"
      ]
    }
  ],
  "notes": [
    "These ranges are observed from live honeypot traffic — they represent active scanning, not necessarily malicious intent.",
    "Blocking scanner ranges reduces noise in logs and lets genuine threat traffic stand out.",
    "Maintain an allowlist for legitimate scanners if you need internet-wide exposure data (e.g. Shodan for asset discovery).",
    "Ranges change over time. Pin to a versioned copy or subscribe to vendor announcements.",
    "CIDR notation: a /24 covers 256 IPs (.0–.255)."
  ]
}