Scanners are the mosquitoes of the internet. Annoying, but mostly harmless, although some may carry pathogens.
Watch an interface exposed to the internet for any length of time and you'll see lots of random-looking attempts to connect (SYN) with services you don't run as well as those you do run. Some traffic is clearly hostile, but some is sent by identifiable entities called scanners, which characteristically publish a webpage (more rarely a whois posting) professing benignity. Nearly all provide an opt-out procedure or disclose the sources of their scans, or both. Their IP addresses pass FCrDNS tests (or the webpage explains why they don't). All This tends to reinforce the benign image promoted by the webpage. Many obscure their identity or discourage scraping of their lists, which damage that image. A couple are hostile. Their generalized, net image is poor, at least in our corner of the SMTP world, judging by Talos and Spamhaus listings.
Scanners find and catalog vulnerabilities on the internet. That catalog can be used defensively, to understand your own vulnerabilities, or offensively, to understand your intended victim's vulnerabilities. Ethical and legal issues surrounding scanning have festered for decades. There are no accepted, formal standards for scanning the global internet, but many people have opinions. You can Kagi for much more. Why are there so damn many scanners? Perhaps that is because there are many markets for this single product.
If we allow our services to be scanned, we leak potentially valuable information to entities with myriad conflicting objectives. Were there a standard for ethical scanning of the global internet, we might agree to it. Lacking one, we will keep ourselves to ourselves
As we are daily reminded of ephemerality of all things, particularly the virtual, it is worth remembering that some of these scanners have operated for decades, and are no longer what they were. We particularly shame stretchoid.com for its tattered state, It does not list the sources of its scans and apparently runs many scanners with no rDNS. Other scanners run on in a zombie state after their webpages disappear, or organizations change.
A limited scanner with well-defined purpose and attribution, from an academic department at Virginia Tech. We allow their scans. Hm, we did until they disappeared; oh wait, we still accept scans from email-probes.cs.vt.edu. When does a scanner become a bot/hacker? When its explanatory webpage disappears? The Wayback Machine knows.
Abuse Contact DB is a limited scanner with a well-defined purpose and attribution, and we allow their scans
University researchers running experiments and scans with specific targets from several hosts with shifting IPs. They publish webpages for specific projects (which include the IPs in current use) but no comprehensive webpage. Individual webpages apparently disappear when scans end. We currently monitor, but allow their probes.
A polite scanner publishes the addresses that send their probes. Part of Project Sonar, Rapid7 Labs runs a polite scanner with well-defined statement of purpose, and they offer free public access to the data. Were we to consider allowing broad scans, we would allow this one.
Onyphe publishes their sending IPs on their front page. They offer an opt-out form, but helpfully suggest recipients simply block those addresses. We follow that advice and drop everything they send.
A Russian business runs a light scanner and provides a statement of "Responsible Scanning Policy.". We drop these scans, as they do not benefit us, though we appreciate their clear statement of policy and responsibility.
A polite but prolific Bulgarian scanner that we drop, with thanks for their open and calm manner
A scanner operated by driftnet.io, provides the platonic ideal of a scanner's webpage, with every piece of relevant information and nothing more. They offer free access to data from your own networks. We block their probes, but were we to use such a service, we might use this one.
Silent Push provides an excellent webpage, including a list of scanning IPs, other identifying characteristics, and an opportunity to opt-out. Their scans are broad but shallow, as claimed. Nicely done. We drop everything they send
Censys, another long-running scanner, began as an academic project of the University of Michigan and now presents itself as an alternative to Shodan for paid users. A polite scanner, they publish sending IPs and ASNs, and we drop their traffic, as suggested.
A polite, active scanner for paid users. We drop probes from their published IP sources, but note that their listing is intentionally difficult to scrape, for no good reason.
ShadowServer is a long-running scanner that sends "free daily reports to our vetted subscribers". We too would prefer a world where we "share what [we] know, so that all parties can become more secure." Unfortunately, that information is also shared with our enemies in the US government and its DOGE operatives, who are actively making the world less secure. It is a rude scanner. We drop everything from the /24s that send their probes.
Infrawatch, a new British business that may be the most active scanner today. They provide no public results, but advertise paid access. Opt-out requests are only accepted by email, where "reasonable exclusion requests and abuse reports are reviewed as promptly as practicable," and they do not publish a list of sending IPs. Their probes can be heavy (e.g., HTTP GET requests sent to our SMTP server). We drop everything AS25369 sends us.
A French security company that scans a small set of commonly abused ports. They provide an opt-out mechanism, but do not list the IPs that send their scans. We drop everything from the small networks they apparently control.
Operated by Baffin Bay, a Swedish company acquired by Mastercard, shadowforce.io scans from Digital Ocean space. They do not identify their source IPs, but do offer an opt-out procedure. Their infrastructure may be changing: as of 9 Oct 2026, they are not scanning, their known hosts no longer resolve (forward or reverse), and their resolvable hosts are located in AWS space. We will drop anything they send.
Despite the name, the Nokia Genome Crawler actually scans specific port ranges over the global internet. They do not offer an opt-out, but do publish the address ranges that send scans, operating out of Microsoft space in AS8075. We drop everything from those IPs.
A very active, apparently Korean scanner. We drop everything from AS202425 (CriminalIP/Recyber/AISpera)
Resposify.net redirects to crowdstrike, which describes its scans in brief, vague terms that don't include "scan". Effectively zombied in a corporate takeover, it scans from four /24s, which we drop.
This Belgian company operates a private scanner to find "leaks." They offer services for "Bounty Hunting" and Enterprises. They offer no opt-out procedure, but publish an excellently geeky probe list (not updated since 2025, which could reflect stability [good!] or drift [bad!]). We thank them for the drop list.
A thin webpage suggests they scan widely for a few ports, provide an email address to request exclusion, and nothing else. They scan from AS 402226 and scattered IPs in linode-akamai space, which we drop. Their rapidly shifting IPs are a bad sign that we will monitor.
German organization that scans a very small set of widely-abused ports (currently five). They provide clear information to identify their probes, an opt-out mechanism AND publish their scanning IPs in a lengthy webpage. They rapidly rotate their scanning hosts, and while they list currently active scanners, they do not list all the IPs they use. We will monitor and drop their probes. Passive observation of probes over an extended period reveals any static set of IPs used by a scanner, and new ones can always be added.
Quadmetrics now redirects to ISS, who tout their "own large scale Internet data collection platform,' presumably quadmetrics. They provide no way to opt-out and do not list the IPs that send their scans, though quadmetrics once did. Effectively zombied.
A specialty scanner, now zombied, that looks for TLS certificates in IPv4 space. It still scans, but the webpage links are broken or timeout. Scans come from a variety of unlisted IPs, which we drop
BinaryEdge was shut down in 2025, but its binaryedge.ninja scanners still operate. They provide no public benefit, and we drop everything from their published list of sending IPs
Begun as a personal project, Shodan has become one of the longest-running scanners. They have no clear government connections, but they now charge for full reports. Rude and dropped, they are.
We've been unable to access Shodan's website for some time, though site detectors show it is up. I tend to agree with romcheckfail that shodan is used mainly for abuse. Shodan has a long history, began as a typical internet scanner, became zombified, and has now slipped into the cesspool of hackerdom. We treat them as such
Stretchoid is not a polite scanner, but as a Microsoft property it doesn't have to be. We drop everything from the /18 networks that send these probes, for reasons. We continue to monitor them and are watching them go dark. Named hosts have become nameless, characteristic stretchoid scans now come from hosts with no rDNS. We will treat them as hackers=bots.
FlowIQ Labs, apparently Brazilian, markets its scanner as a hacker support tool, telling its users: "How we scan, and the line we do not cross. The method is published because it is the thing that makes this legitimate." I read this as "we supply the targets, you fire the gun." While they publish webpages, they do not publish the addresses that send their scans, and describe a 3 step opt-out process and, apparently, may not actually delete your data. Scanning IPs reverse as embnex.com, but fail FCrDNS. Scans come from 16.5.0.0/24, which we treat as hacker space.