Shodan.io portscans | Joachim De Zutter
September 2016 - April 2017

Some suspicious TCP port scans from *.shodan.io were detected:
2016-10-04 10:58 71.6.158.166
2016-10-26 16:05 82.221.105.7
2016-10-26 16:06 82.221.105.7
2016-10-28 16:56 198.20.87.98
2016-11-18 07:16 82.221.105.6
2016-11-23 10:12 188.138.9.50
2016-11-29 14:18 66.240.219.146
2016-12-12 05:48 66.240.219.146
2017-01-05 03:56 66.240.192.138
2017-01-08 03:12 82.221.105.6
2017-01-10 18:16 71.6.165.200
2017-01-10 18:17 71.6.165.200
2017-01-18 15:49 71.6.135.131
2017-01-27 23:39 71.6.167.142
2017-01-29 17:37 66.240.219.146
2017-01-31 00:34 71.6.165.200
2017-02-06 01:29 198.20.69.98
2017-02-06 02:08 198.20.69.98
2017-02-08 19:08 66.240.236.119
2017-02-09 03:34 71.6.167.142
2017-02-17 05:02 82.221.105.6
2017-02-25 18:37 66.240.219.146
2017-02-26 07:52 198.20.87.98
2017-03-02 16:28 198.20.69.98
2017-03-06 15:51 71.6.165.200
2017-03-06 22:01 198.20.87.98
2017-03-09 02:31 66.240.219.146
2017-03-10 20:33 71.6.167.142
2017-03-19 13:14 71.6.158.166
2017-03-28 20:19 66.240.236.119
2017-03-28 20:43 66.240.236.119
2017-04-01 10:05 198.20.69.98
2017-04-02 02:55 66.240.219.146
Some suspicious HTTP requests from *.shodan.io were also found in an HTTP server log:
66.240.236.119 - - [12/Sep/2016:02:01:49 +0300] "GET / HTTP/1.1" 200 28342 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [12/Sep/2016:02:01:50 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
66.240.236.119 - - [12/Sep/2016:02:01:51 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
66.240.236.119 - - [12/Sep/2016:02:02:08 +0300] "GET / HTTP/1.1" 200 28342 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [12/Sep/2016:02:02:09 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
66.240.236.119 - - [12/Sep/2016:02:02:09 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
66.240.236.119 - - [12/Sep/2016:02:02:23 +0300] "GET / HTTP/1.1" 200 28342 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [12/Sep/2016:02:02:24 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
66.240.236.119 - - [12/Sep/2016:02:02:24 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
71.6.158.166 - - [21/Sep/2016:05:19:10 +0300] "GET / HTTP/1.1" 200 28562 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
71.6.158.166 - - [21/Sep/2016:05:19:10 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
71.6.158.166 - - [21/Sep/2016:05:19:11 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
71.6.158.166 - - [21/Sep/2016:05:19:25 +0300] "GET / HTTP/1.1" 200 28562 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
71.6.158.166 - - [21/Sep/2016:05:19:26 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
71.6.158.166 - - [21/Sep/2016:05:19:26 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
71.6.158.166 - - [21/Sep/2016:05:19:40 +0300] "GET / HTTP/1.1" 200 28562 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
71.6.158.166 - - [21/Sep/2016:05:19:41 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
71.6.158.166 - - [21/Sep/2016:05:19:42 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
198.20.87.98 - - [29/Sep/2016:04:37:08 +0300] "GET /robots.txt HTTP/1.1" 404 444 "-" "-"
198.20.87.98 - - [29/Sep/2016:04:37:09 +0300] "GET /sitemap.xml HTTP/1.1" 404 445 "-" "-"
198.20.69.98 - - [14/Oct/2016:22:27:06 +0300] "GET / HTTP/1.1" 200 30813 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
198.20.69.98 - - [14/Oct/2016:22:27:07 +0300] "GET /robots.txt HTTP/1.1" 200 281 "-" "-"
198.20.69.98 - - [14/Oct/2016:22:27:08 +0300] "GET /sitemap.xml HTTP/1.1" 200 21274 "-" "-"
198.20.69.74 - - [16/Oct/2016:12:31:47 +0300] "GET / HTTP/1.1" 200 30813 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
198.20.69.74 - - [16/Oct/2016:12:31:48 +0300] "GET /robots.txt HTTP/1.1" 200 281 "-" "-"
198.20.69.74 - - [16/Oct/2016:12:31:49 +0300] "GET /sitemap.xml HTTP/1.1" 200 21274 "-" "-"
198.20.69.98 - - [23/Oct/2016:17:41:46 +0300] "GET / HTTP/1.1" 200 32555 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
198.20.69.98 - - [23/Oct/2016:17:41:47 +0300] "GET /robots.txt HTTP/1.1" 200 281 "-" "-"
198.20.69.98 - - [23/Oct/2016:17:41:48 +0300] "GET /sitemap.xml HTTP/1.1" 200 21275 "-" "-"
71.6.165.200 - - [18/Nov/2016:09:31:16 +0200] "GET / HTTP/1.1" 200 34337 "-" "Mozilla/5.0 (Windows NT 6.1) AppeWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
71.6.165.200 - - [18/Nov/2016:09:31:17 +0200] "GET /robots.txt HTTP/1.1" 200 281 "-" "-"
71.6.165.200 - - [18/Nov/2016:09:31:17 +0200] "GET /sitemap.xml HTTP/1.1" 200 21631 "-" "-"
71.6.165.200 - - [18/Nov/2016:09:31:31 +0200] "GET / HTTP/1.1" 200 34337 "-" "Mozilla/5.0 (Windows NT 6.1) AppeWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
71.6.165.200 - - [18/Nov/2016:09:31:31 +0200] "GET /robots.txt HTTP/1.1" 200 281 "-" "-"
71.6.165.200 - - [18/Nov/2016:09:31:32 +0200] "GET /sitemap.xml HTTP/1.1" 200 21631 "-" "-"
71.6.165.200 - - [18/Nov/2016:09:31:47 +0200] "GET / HTTP/1.1" 200 34337 "-" "Mozilla/5.0 (Windows NT 6.1) AppeWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
71.6.165.200 - - [18/Nov/2016:09:31:48 +0200] "GET /robots.txt HTTP/1.1" 200 281 "-" "-"
71.6.165.200 - - [18/Nov/2016:09:31:48 +0200] "GET /sitemap.xml HTTP/1.1" 200 21631 "-" "-"
198.20.69.74 - - [29/Jan/2017:11:26:22 +0200] "GET / HTTP/1.1" 200 38049 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
198.20.69.74 - - [29/Jan/2017:11:26:23 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
198.20.69.74 - - [29/Jan/2017:11:26:24 +0200] "GET /sitemap.xml HTTP/1.1" 200 17202 "-" "-"
66.240.236.119 - - [31/Jan/2017:16:13:31 +0200] "GET / HTTP/1.1" 200 38134 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [31/Jan/2017:16:13:32 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
66.240.236.119 - - [31/Jan/2017:16:13:32 +0200] "GET /sitemap.xml HTTP/1.1" 200 17202 "-" "-"
66.240.236.119 - - [31/Jan/2017:16:13:44 +0200] "GET / HTTP/1.1" 200 38134 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [31/Jan/2017:16:13:45 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
66.240.236.119 - - [31/Jan/2017:16:13:45 +0200] "GET /sitemap.xml HTTP/1.1" 200 17202 "-" "-"
66.240.236.119 - - [31/Jan/2017:16:14:00 +0200] "GET / HTTP/1.1" 200 38134 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [31/Jan/2017:16:14:01 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
66.240.236.119 - - [31/Jan/2017:16:14:01 +0200] "GET /sitemap.xml HTTP/1.1" 200 17202 "-" "-"
66.240.236.119 - - [04/Feb/2017:07:37:45 +0200] "GET / HTTP/1.1" 200 38708 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [04/Feb/2017:07:37:46 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
66.240.236.119 - - [04/Feb/2017:07:37:47 +0200] "GET /sitemap.xml HTTP/1.1" 200 17217 "-" "-"
66.240.236.119 - - [04/Feb/2017:07:38:00 +0200] "GET / HTTP/1.1" 200 38708 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [04/Feb/2017:07:38:01 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
66.240.236.119 - - [04/Feb/2017:07:38:02 +0200] "GET /sitemap.xml HTTP/1.1" 200 17217 "-" "-"
66.240.236.119 - - [04/Feb/2017:07:38:15 +0200] "GET / HTTP/1.1" 200 38708 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
66.240.236.119 - - [04/Feb/2017:07:38:16 +0200] "GET /robots.txt HTTP/1.1" 200 1481 "-" "-"
66.240.236.119 - - [04/Feb/2017:07:38:17 +0200] "GET /sitemap.xml HTTP/1.1" 200 17217 "-" "-"
66.240.205.34 - - [04/Apr/2017:13:46:57 +0300] "Gh0st\xad" 400 0 "-" "-"
On June 19th, 2017 some suspicious connections from *.shodan.io were also found in /var/log/auth.log :
Jun 19 09:26:02 - sshd[410]: Did not receive identification string from 66.240.236.119 port 46200
Jun 19 09:26:03 - sshd[411]: Connection closed by 66.240.236.119 port 46350 [preauth]
Jun 19 09:26:04 - sshd[413]: Connection closed by 66.240.236.119 port 46696 [preauth]
Jun 19 09:26:09 - sshd[415]: Did not receive identification string from 66.240.236.119 port 48147
Jun 19 09:26:11 - sshd[416]: Connection closed by 66.240.236.119 port 48281 [preauth]
Jun 19 09:26:11 - sshd[418]: Connection closed by 66.240.236.119 port 48549 [preauth]
Jun 19 09:26:17 - sshd[420]: Did not receive identification string from 66.240.236.119 port 49873
Jun 19 09:26:18 - sshd[421]: Connection closed by 66.240.236.119 port 49981 [preauth]
Jun 19 09:26:29 - sshd[423]: Connection closed by 66.240.236.119 port 50258 [preauth]
Jun 19 09:26:33 - sshd[425]: Did not receive identification string from 66.240.236.119 port 54646
Jun 19 09:26:34 - sshd[426]: Connection closed by 66.240.236.119 port 54806 [preauth]
Jun 19 09:26:38 - sshd[428]: Connection closed by 66.240.236.119 port 55160 [preauth]
Passive OS fingerprinting gave the following information:
82.221.105.6:61819 - UNKNOWN [35707:115:0:40:.:.:?:?] 
71.6.165.200:34680 - UNKNOWN [30063:114:0:40:.:.:?:?] [high throughput] 
71.6.165.200:51085 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:51555 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:51642 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:54852 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:54946 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:55420 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:59166 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:59532 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
71.6.165.200:59626 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 1585 hrs) 
188.138.9.50:40082 - UNKNOWN [51329:115:0:40:.:.:?:?] [low delay] 
66.240.219.146:40082 - UNKNOWN [49484:114:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
66.240.219.146:49559 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 519 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
66.240.219.146:49826 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 519 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
66.240.219.146:54206 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 519 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
66.240.219.146:54543 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 519 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
198.20.69.74:34680 - UNKNOWN [22352:112:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
198.20.69.74:33480 - UNKNOWN [S20:47:1:60:M1460,S,T,N,W7:.:?:?] (up: 575 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
198.20.69.74:33773 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 575 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
198.20.69.74:33995 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 575 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.219.146:61819 - UNKNOWN [64455:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
66.240.192.138:61819 - UNKNOWN [10253:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
71.6.146.185:34680 - UNKNOWN [55969:114:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
71.6.146.185:38007 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 382 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
71.6.146.185:38463 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 382 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
71.6.146.185:38607 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 382 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
71.6.146.185:41841 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 382 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
71.6.146.185:42493 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 382 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
71.6.146.185:42702 - UNKNOWN [S20:50:1:60:M1460,S,T,N,W7:.:?:?] (up: 382 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
82.221.105.6:40082 - UNKNOWN [4260:115:0:40:.:.:?:?] -> 192.168.0.27:22 (link: unspecified)
71.6.165.200:40082 - UNKNOWN [54773:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
71.6.165.200:52955 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 1303 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
71.6.165.200:54361 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 1303 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
71.6.165.200:54497 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 1303 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
71.6.165.200:54936 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 1303 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
71.6.165.200:58894 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 1303 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
71.6.165.200:59467 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 1303 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
71.6.135.131:61819 - UNKNOWN [41015:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
66.240.236.119:34680 - UNKNOWN [6811:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
66.240.236.119:43177 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 615 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:45454 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 615 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
71.6.167.142:61819 - UNKNOWN [44348:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
198.20.69.74:34680 - UNKNOWN [11635:112:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
198.20.69.74:44567 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 1101 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
198.20.69.74:44782 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 1101 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
198.20.69.74:45001 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 1101 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.219.146:40082 - UNKNOWN [34828:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
71.6.165.200:61819 - UNKNOWN [8671:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
66.240.236.119:34680 - UNKNOWN [64269:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
66.240.236.119:45412 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:45509 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:45554 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:47680 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:48026 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:48188 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:51058 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:51208 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:51318 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 34 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:34680 - UNKNOWN [48274:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
66.240.236.119:53767 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:54084 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:54130 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:56918 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:57164 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:57231 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:59581 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:59713 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
66.240.236.119:59845 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 252 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
198.20.69.98:40082 - UNKNOWN [36826:112:0:40:.:.:?:?] -> 192.168.0.27:22 (link: unspecified)
198.20.69.98:46033 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 356 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
198.20.69.98:46033 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 356 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
198.20.69.98:46033 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 356 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
198.20.69.98:46033 - UNKNOWN [S20:48:1:60:M1460,S,T,N,W7:.:?:?] (up: 356 hrs) -> 192.168.0.27:22 (link: ethernet/modem)
66.240.236.119:61819 - UNKNOWN [5390:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
71.6.167.142:61819 - UNKNOWN [34480:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
66.240.236.119:34680 - UNKNOWN [30263:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
82.221.105.6:34680 - UNKNOWN [40324:115:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
82.221.105.6:40082 - UNKNOWN [4881:115:0:40:.:.:?:?] -> 192.168.0.27:22 (link: unspecified)
198.20.69.74:34680 - UNKNOWN [43539:112:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
66.240.219.146:40082 - UNKNOWN [37724:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
198.20.87.98:61819 - UNKNOWN [624:117:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
Thu Mar  2 15:28:20 2017 198.20.69.98:61819 - UNKNOWN [25355:113:0:40:.:.:?:?] -> 192.168.0.27:21 (link: unspecified)
Sat Mar  4 19:04:24 2017 198.20.69.98:34680 - UNKNOWN [26351:113:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
Mon Mar  6 14:51:43 2017 71.6.165.200:40082 - UNKNOWN [40316:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
Mon Mar  6 21:01:06 2017 198.20.87.98:40082 - UNKNOWN [42005:117:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
Thu Mar  9 01:31:30 2017 66.240.219.146:40082 - UNKNOWN [51166:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
Thu Mar  9 12:49:43 2017 71.6.135.131:34680 - UNKNOWN [11531:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
Fri Mar 10 19:33:54 2017 71.6.167.142:61819 - UNKNOWN [50555:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
Sun Mar 19 12:14:14 2017 71.6.158.166:61819 - UNKNOWN [12339:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
Mon Mar 20 02:34:29 2017 198.20.69.74:34680 - UNKNOWN [49936:113:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
Tue Mar 28 20:19:25 2017 66.240.236.119:40082 - UNKNOWN [49969:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:22 (link: unspecified)
Tue Mar 28 20:43:44 2017 66.240.236.119:61819 - UNKNOWN [31473:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
Sat Apr  1 10:05:16 2017 198.20.69.98:61819 - UNKNOWN [49276:113:0:40:.:.:?:?] -> 192.168.0.27:21 (link: unspecified)
Sun Apr  2 02:55:12 2017 66.240.219.146:61819 - UNKNOWN [57055:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:21 (link: unspecified)
Tue Apr  4 12:46:58 2017 66.240.205.34:33694 - UNKNOWN [8562:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
Tue Apr  4 13:46:57 2017 66.240.205.34:48120 - UNKNOWN [S20:49:1:60:M1460,S,T,N,W7:.:?:?] (up: 25 hrs) -> 192.168.0.27:80 (link: ethernet/modem)
Wed Apr  5 03:55:26 2017 66.240.205.34:33694 - UNKNOWN [688:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
Tue May  9 07:30:37 2017 198.20.69.74:34680 - UNKNOWN [41944:113:0:40:.:.:?:?] -> 192.168.0.27:80 (link: unspecified)
Wed May  3 09:40:07 2017 82.221.105.6:40082 - UNKNOWN [50267:115:0:40:.:.:?:?] -> 192.168.0.27:22 (link: unspecified)
Fri May  5 09:53:28 2017 66.240.192.138:34680 - UNKNOWN [5636:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:80 (link: unspecified)
Fri May 12 05:22:45 2017 71.6.165.200:20012 - UNKNOWN [13651:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:311 (link: unspecified)
Fri May 12 08:09:40 2017 71.6.135.131:27153 - UNKNOWN [36073:113:0:40:.:.:?:?] [high throughput] -> 192.168.0.27:992 (link: unspecified)
How to block Shodan scanners