Know Who's Scanning.
Block Them First.

Internet scanners are automated systems that continuously probe IP addresses and ports across the internet, searching for open services, vulnerabilities, and misconfigured systems. While some scanning activity is legitimate (e.g., academic research projects like Shodan or Censys), the majority of high-volume scanning is associated with malicious reconnaissance — the first stage of a cyberattack.

Whatoblock's global network of honeypot sensors captures and analyzes these scanning attempts in real time. Each sensor emulates vulnerable services to attract and log scanner interactions, including which protocols are targeted (DNS, NTP, SSDP, SNMP, and more), source IPs, geographic origins, and scanning frequency.

This page provides a daily-updated ranking of the top 10 most active scanner IPs detected over the current observation window. The 30-day activity timeline for each scanner reveals persistence patterns — whether a scanner operates in bursts or maintains continuous reconnaissance. Security teams can use this data to proactively block known aggressive scanners, enrich their threat intelligence feeds, and understand the current scanning landscape.

How to Use This Data

• Cross-reference scanner IPs with your firewall or SIEM logs to detect reconnaissance against your infrastructure
• Use the first-seen and last-seen timestamps to assess scanner persistence and operational patterns
• Analyze targeted protocols to understand which services attackers are currently focused on
• Incorporate this data into your daily threat briefings or SOC dashboards

Data is sourced from Whatoblock's proprietary honeypot network. For programmatic access, explore our API documentation. To dive deeper into scanner analytics, create a free account.