misp-warninglists/lists/shadowforce-nt-scanning/list.json at main · MISP/misp-warninglists · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
{
  "description": "List containing IP's associated with the Shadowforce scanners. This scanner CIDR range is extracted from CIRCL Network Telescope analysis on 2026/04/09",
  "list": [
    "128.199.44.215/32",
    "142.93.135.160/32",
    "146.190.21.73/32",
    "152.42.136.22/32",
    "159.223.0.20/32",
    "159.223.231.254/32",
    "159.65.193.17/32",
    "159.65.206.235/32",
    "161.35.145.35/32",
    "164.92.148.118/32",
    "164.92.159.100/32",
    "164.92.215.178/32",
    "164.92.219.121/32",
    "165.22.193.223/32",
    "167.172.47.74/32",
    "167.99.211.88/32",
    "178.128.250.218/32",
    "209.38.165.60/32",
    "209.38.96.38/32",
    "68.183.11.224/32",
    "68.183.3.153/32"
  ],
  "matching_attributes": [
    "ip-src",
    "ip-dst",
    "domain|ip",
    "ip-dst|port",
    "ip-src|port"
  ],
  "name": "Shadowforce IP Ranges Used for Scanning",
  "type": "cidr",
  "version": 26040914
}