Scanning Engine v2 - Blocking

Introduction

Our scanning engine is comprised of a cluster coordinator called 'Krang' and thousands of hosts called 'Minions' that survey the entire publicly-addressable Internet on a regular basis. Due to these surveys and other research, you may have received traffic originating from our Minions. If you would prefer not to receive traffic from us in future, you have two options: blocking on our side or blocking on your side.

Blocking on Our Side

We recommend this method because it is the most reliable. To have your IP addresses or network ranges added to our blocklist, please email us at [email protected]. Please include the following information:

1. Your name and the organization you represent, if any
2. The IP addresses or network ranges you'd like us to block on our side
3. The date, time, and addresses, if any, that contacted your hosts

This information will help us double-check that the scanning engine was the source of the traffic you received, ensure that there are no other sources of traffic coming from us, and get back to you if we have additional questions.

Blocking on Your Side

We do not recommend this method because the hosts from which our scans originate are ephemeral and not associated with their IP addresses over the long-term. We publish an up-to-the-moment list of the addresses currently associated with our Minions here. Its format is as follows:

{
  "scanners": [
    "ipv4-address-1",
    ...
    "ipv4-address-N",
    "ipv6-address-1",
    ...
    "ipv6-address-M"
  ]
}

The list of Minion addresses for v1 of our scanning engine are available here (IPv4) and here (IPv6). Please note that all of these endpoints are rate-limited, meaning if you request them too often you will receive HTTP 429 Too Many Requests responses.