You saw a connection from this address. Here is what it was.

This host belongs to , a public IP reputation and geolocation lookup service. It does not scan the internet on its own. It measures a range only after someone looks up an address in that range on cleanip.io, most often the person using that address, such as a customer checking the IP they rent from you.

What it does

1. Someone looks up an address on cleanip.io, usually to check the IP they are using or renting.
2. This host samples up to 32 addresses in the same /24 to tell hosting ranges from residential ones.
3. Each sampled address gets a few ICMP echo requests and ordinary TCP connections to these ports:
   804431080205320832087209631288080844310086
4. On an open port it completes a normal handshake, reads the TLS certificate or makes one GET / request, and disconnects.

What it never does

• It does not choose targets itself. Without a lookup there is no measurement.
• It does not try to log in, send exploits, or guess credentials.
• It does not measure the same /24 more than once every 14 days.

Stop the measurements

Enter the address or range you want left alone. Your own address, or the /24 around it, is excluded immediately. Wider ranges, and ranges you are not visiting from, are checked by a person first.