Scan Infrastructure
What we scan, from where, why — and how to reach us
Abuse Contact
If our scan traffic is causing you trouble or you want your network excluded, email us. We reply within 24 hours and apply opt-out exclusions on the next scan cycle.
Source IP Ranges
All Network-Intelligence scans originate from one of the following dedicated ranges. These are isolated from our 65+ user-facing probe nodes (the ones that run Ping/MTR/HTTP/etc. when users submit a check). If you see scan traffic from another check-host.cc IP that is NOT listed here, please email us — that's not us.
JSON-machine-readable: https://check-host.cc/about/scan-infra.json
Methodology
What we send
SYN packets to a curated port set (default: 20 well-known service ports). When a SYN-ACK comes back, we record (IP, port, timestamp) and follow up with one banner-grab per open port — typically an HTTP GET / or a TLS handshake. No payloads beyond what an ordinary HTTP/TLS client would send.
What we do NOT send
No exploit payloads, no credential-guessing, no targeted application probes, no UDP amplification probes. We never log into anything.
Rate
World-sweeps run at ~1 Mpps with randomised host order — your /24 sees roughly 20 packets total during a full sweep, spread across minutes. On-demand scans probe at most one IP each at gentle rates.
Frequency
Top-20 ports: once daily. Top-200 ports: weekly. Top-500: monthly. On-demand scans whenever a user submits one through the Fullscan tool.
Storage
Results go into our ClickHouse data warehouse. Records are retained for 5 years on a hot-warm-cold storage tier policy. Personal data is NEVER deliberately collected; HTML bodies that arrive in our scans are truncated to ~1 MB and reviewed for accidental PII before being indexed.
Continuous origin-IP leak detection
Whenever our scans capture a TLS certificate, we automatically check each Subject-Alt-Name against current public DNS. If a SAN normally resolves through a CDN/cloud edge (Cloudflare, Akamai, Fastly, AWS, Google, Azure, etc.) but we just observed it on a non-CDN IP, that observation is flagged as a potential origin-IP leak. This is passive — no extra probes are sent. Opt out if you do not want your network analysed this way.
Tooling
masscan
SYN-only port discovery — the same tool ZMap researchers + most large-scale internet measurement projects use. Open source.
zgrab2
Application-layer banner grabbing on ports discovered by masscan. Maintained by ZMap project; standard tool of academic internet measurement.
User-Agent
check-host.cc Intel Platform (https://check-host.cc/about/scan-infra; abuse@check-host.cc)
Opt-Out Request
Email abuse@check-host.cc with one of:
- Your CIDR range (e.g.
203.0.113.0/24) - Your ASN (e.g.
AS64500) - A domain you operate (we'll match to NS / A records)
Opt-outs are applied on the next sweep cycle (≤24h) and are permanent until revoked. We log opt-out requests for compliance but never publish them.
Legal & Compliance
Active port scanning is generally lawful in most jurisdictions when conducted in good faith without payload injection or unauthorized access (cf. Bundesgerichtshof, US v. Auernheimer, etc.). Our scans only send a SYN packet plus a single application-layer probe and never attempt authentication.
If your jurisdiction or contract requires our scans to stop targeting your network specifically, the opt-out mechanism above is the fastest path. We do not need to be told why — a single one-line request is enough.
For research collaboration, dataset sharing, or coordinated disclosure of exposed services we observed, contact research@check-host.cc.