Block all Shodan scanners

[Kevin_Orrison]

I'm not getting much guidance from TAC so I thought I'd post here too. I have all the Shodan IPS signatures in prevent mode, but we still get his from their scanners. I'm wondering the best way to completely block all their scanning attempts. 

[the_rock]

Hi Kevin,

Maybe check below link and also, can you attach a screenshot of one of those hits you get?

Andy

https://blog.checkpoint.com/2016/01/04/check-point-threat-alert-shodan/

[CheckPointerXL]

hey kevin, same problem here...any solution found? i wanna make IPS work lighter by preventing scanner @ L3/L4 level

[Chris_Atkinson · Accepted solution]

Danny has posted about something similar before:

https://community.checkpoint.com/t5/Management/HowTo-Block-IoT-scanners-like-Shodan-Censys-Shadowser...

Network Feeds feature (R81.20) may also be helpful here:

https://community.checkpoint.com/t5/Management/R81-20-TechTalk-webinar-Network-Feed-Objects/td-p/162...