Kudelski Security Innovation

Port Scanner

[blend27]

Requests are coming from 185.35.62.0/23.

Headers are almost blank.

The UAs are random 2 letters from English Alphabet.

[keyplyr]

Kudelski Security Innovation
185.35.62.0 - 185.35.63.255
185.35.62.0/23

This IP network is used for Internet security research. Internet-scale port scanning activities are launched from this network. Don't hesitate to contact [e-mail] would you have any question.

[lucy24]

Headers are almost blank.

The UAs are random 2 letters from English Alphabet.

This sounds like a self-solving problem :) If they receive a 403, all is good. If you're handing out 200s, you may need their services.

[keyplyr]

If they receive a 403, all is good.

Be carefu. If you have a business site, this is not one you want to block. They supply a great number of company firewalls with their "safe" index.

[lucy24]

I checked logs before posting. If that's their only IP, I must not have any content of interest to them :(

I do see your point, though. Back when I did strictly IP-based blocking, I had to unblock one proxy because it was used by all employees of a particular governmental entity that had frequent reason to visit one site. (Fortunately they had an IT guy who figured out what was going on, and contacted me* directly.)


* Where “me” = webmaster@whatever-it-was.