Shodan scanner: is it malicious, and can you block it?

Shodan is a search engine for internet-connected devices. It connects to public services and records what they reveal, so a visit usually means your service is reachable, not that you were singled out. We could not find an official Shodan list of scanner addresses, so identifying it takes more care than Censys.

How to recognise it

Check the reverse DNS name of the address. Security vendors commonly report names ending in census.shodan.io, though that comes from third-party documentation rather than Shodan.

dig -x 203.0.113.7 +short

Then confirm that the name resolves back to the same address, because whoever controls a network can set its reverse DNS to anything:

dig +short NAME_FROM_THE_FIRST_COMMAND

Is it malicious?

Shodan is a legitimate service used by defenders and researchers, but anyone can search its results, including attackers. Treat it as a reminder that your service is publicly visible. If something should not be exposed, closing it matters more than blocking one scanner.

Can you block it?

You can, with these limits:

• Published address lists are unofficial, and they go stale when addresses change.
• A partial block may not stop every scan.
• Blocking does not necessarily remove what was already recorded.

To see how isipsafe rates a specific address, look it up. If it scores highly, you can block it with the rest of the blacklist.