Re: [Pool] shodan.io actively infiltrating ntp.org IPv6 pools for scanning purposes

[Rob Janssen <rob () knoware nl eu org>]

Luca BRUNO wrote:
> [cross-posted to pool-ntp and oss-sec]
>
>
> For ntp.org admins: can those rogue server be expunged from the pools, and the whole
> shodan.io situation clarified?

shodan.io are the bad guys!  block them wherever possible, put them in default blocklists suggested
for firewalls, etc.

these guys really don't care.   when submitting networks for exclusion, they reply as if they will do something,
sometimes the scanning may pause for a day or a week, then it always comes back.

Rob