IP and CIDR targets

What can be a target

A single public IPv4 address, or a CIDR range of at most 256 addresses (/24). Larger ranges are refused with "Split it into blocks of /24 or smaller". Private, loopback, link-local, multicast and other reserved ranges are refused outright, and the guardrail runs again inside the scan itself as defence in depth.

The attestation

Before a target is scanned you must agree to the exact statement:

I own, operate, or am authorized in writing to run security scans against this IP address or network.

The attestation is stored with the target, with who gave it and when. Over MCP, add_ip_target takes attestation: true, and the tool's instructions tell the assistant to pass it only after you have said so in words.

Auto-verification from inside the range

If you add a target while connected from an address inside it (the office network, a VPN that exits through the range), the request's source address proves the point and no attestation is needed. The target is recorded as connected-from with "Auto-verified: request originated from <ip>, inside the target". In the iOS app the add form offers Use this connection with the public address the phone is using.

Scanning

When	What
At add time	Targets of 32 addresses or fewer start scanning straight away (if the account has an on-demand scan left), and you are notified when the result lands; the add itself answers before the scan finishes. Larger ranges are picked up by the next hourly pass instead, so a /24 is never 256 addresses probed inside the add request
Daily	About once a day: every hour, any target with `daily_scan` on that has not been scanned in the last 23 hours is scanned, once the scanner is free. There is no fixed time of day
Scan now	`POST /api/ip-targets/:id/scan` (tool `scan_ip_target`), once per hour per target. Small ranges answer inside the request; larger ones are queued

The add-time scan and Scan now are on-demand scans, counted per account in any 24 hours: 3 on Free, 10 on Starter, 25 on Pro, 100 on Enterprise. The count survives deleting the target. Over the limit, the target is still added and the daily pass scans it; Scan now is refused with the time to wait. The daily pass is not counted.

The probe is the same 134-port TCP connect scan the domain scanner uses, from our server at 107.173.3.11 (or a sandboxed Cloudflare container when that server is busy). See Hosts and open ports.

Results

Each scan records, per address, the open ports with the service name (from the banner where one was read, otherwise by what the port number means), the version where visible, and a risk note. GET /api/ip-targets/:id/scans (tool list_ip_target_scans) lists past scans so a newly opened port is visible as a change.

Clients

A target can be filed under a scan client (client_id) so a customer's ranges sit with their domains. See Groups, Personal and Business.

Removing

DELETE /api/ip-targets/:id stops scanning and removes the target with its history. Turn daily_scan off with PATCH to pause instead.

Common questions

Can I add a hostname? No. Hostnames are domains; add the domain and its hosts are discovered. Network targets are for addresses that have no domain of their own.

IPv6? Not yet. The guardrail and the probe are IPv4.

Will the scan trip my IDS? It is a connect scan against 134 ports from 107.173.3.11, paced and bounded. An intrusion detection system will log it; it will not see an exploit attempt.