-It is a hacker!
-It is Shodan!
...
+No, it's just NCSC, scanning your public IPs.
NCSC made a statement that they will be scanning public IPs hosted in the UK against vulnerabilities. They will be coming from the following 2 IP addresses. In case you see them in your logs, don't worry (or worry)
18.171.7.246
35.177.10.231
Also, if you don't want to be scanned and opt-out, you can contact NCSC via scanning@ncsc.gov.uk
https://www.ncsc.gov.uk/information/ncsc-scanning-information