Shadowserver — scanner ranges via ASN ownership (AS22168), checked per IP
by shop owners for shop owners.
How the PARC feed for the Shadowserver Foundation came about: 26 prefixes announced by AS22168, every IP confirmed individually as AS22168 — 8,704 of 8,704, fully homogeneous.
The Shadowserver Foundation (non-profit, US) runs one of the largest internet-wide security scanners from its own ASN AS22168. Not an SEO tool. Identification is via ASN ownership (BGP/RDAP): 26 announced prefixes = 8,704 IPs. We checked every single IP for its origin ASN. Part of our PARC Security feed.
shadowserver.json — view feed shadowserver.org →
Per-IP verification — fully homogeneous
Shadowserver scan IPs have no self-identifying reverse DNS, but they belong to an own, registered ASN — a solid ownership proof (unlike rented cloud IPs). After the Alpha Strike finding (where 38% of the range was foreign) we did not trust the announced list here either, but checked each of the 8,704 IPs individually for its origin ASN:
8,704 IPs → 8,704 × AS22168 (100%, no foreign delegation)
Unlike Alpha Strike, Shadowserver’s 26 prefixes are fully homogeneous — no needles, no sub-delegated blocks. The entire range is Shadowserver.