Reposify (CrowdStrike) — the verified scanner block and how we proved it via FCrDNS
by shop owners for shop owners.
How the PARC feed for Reposify was built: Reposify publishes no official IP list — we verified the scanner EIPs in AWS fully bidirectionally via FCrDNS against *.reposify.net. 449 IPv4, every address individually confirmed.
Reposify is an internet-wide attack-surface scanner — it scans the internet for exposed assets to show companies their external attack surface. Acquired by CrowdStrike in 2022. Not an SEO tool. Reposify publishes no official IP list — so we verified the active scanner EIPs fully via bidirectional FCrDNS against *.reposify.net. Part of our PARC Security feed.
reposify.json — view feed CrowdStrike (Reposify) →
The blocks
449 IPv4, in AWS (us-east-1, Northern Virginia):
44.220.185.0/24 228 IPs scanner-44-220-185-NN.reposify.net
44.220.188.0/24 221 IPs scanner-44-220-188-NN.reposify.net
Each address is listed individually as /32 — no /24 aggregation, because the same AWS /24 also holds generic EC2 instances of other customers. Only what proves itself via DNS goes in.
No official list — and why the AWS ASN isn’t enough
Reposify/CrowdStrike publishes no scanner IP list. The EIPs sit in Amazon (AS14618, us-east-1) — so an ASN filter would be worthless, it would catch half of AWS. The only reliable signal is the reverse DNS scanner-{ip}.reposify.net that Reposify sets itself. Verification therefore runs entirely through DNS.
FCrDNS proof — both directions, every address
Reverse-sweep of the AWS blocks, then forward-confirm each hit against *.reposify.net. Only bidirectionally confirmed addresses enter the feed:
Reverse:
44.220.188.1 → scanner-44-220-188-1.reposify.net
44.220.185.88 → scanner-44-220-185-88.reposify.net
Forward-confirm:
scanner-44-220-188-1.reposify.net → 44.220.188.1
scanner-44-220-185-88.reposify.net → 44.220.185.88
Generic neighbours with ec2-….amazonaws.com PTR drop out automatically in the FCrDNS test. A discovery probe across the entire 44.220.0.0/16 yielded exactly these two Reposify /24s — so the block is fully captured for this AWS range and is re-swept regularly.
Hostname pattern
scanner-{a}-{b}-{c}-{d}.reposify.net (encodes its own IP)