topic Re: Block all Shodan scanners in Firewall and Security Management

Block all Shodan scanners

Kevin_Orrison — Fri, 12 Mar 2021 17:40:31 GMT

I'm not getting much guidance from TAC so I thought I'd post here too. I have all the Shodan IPS signatures in prevent mode, but we still get his from their scanners. I'm wondering the best way to completely block all their scanning attempts.

Re: Block all Shodan scanners

the_rock — Sun, 14 Mar 2021 02:06:13 GMT

Hi Kevin,

Maybe check below link and also, can you attach a screenshot of one of those hits you get?

Andy

https://blog.checkpoint.com/2016/01/04/check-point-threat-alert-shodan/

Re: Block all Shodan scanners

CheckPointerXL — Mon, 16 Jan 2023 19:35:56 GMT

hey kevin, same problem here...any solution found? i wanna make IPS work lighter by preventing scanner @ L3/L4 level

Re: Block all Shodan scanners

Chris_Atkinson — Mon, 16 Jan 2023 22:16:38 GMT

Danny has posted about something similar before:

https://community.checkpoint.com/t5/Management/HowTo-Block-IoT-scanners-like-Shodan-Censys-Shadowserver-PAN/td-p/124612

Network Feeds feature (R81.20) may also be helpful here:

https://community.checkpoint.com/t5/Management/R81-20-TechTalk-webinar-Network-Feed-Objects/td-p/162590