Domain / IP / CIDR / ASN / list → normalized IPs (DoH resolve, CIDR guard).
2 · Port scan (distributed)
Connect-scan the dangerous-service port set, fanned across the fleet.
3 · Fingerprint & check
httpx identifies web services; nuclei checks exposed network services.
4 · Grade
A–F exposure grade + dangerous-service list + remediation (dark PDF + results.jsonl).
Overview
Knowing what your network exposes means starting from whatever you happen to
have, a domain, an ASN, or a raw CIDR, and ending with a straight answer: which
hosts have dangerous services open to the internet. This workflow takes one input
of any of those types, resolves it to the addresses worth scanning, and guards
the blast radius so a single cloud ASN cannot turn into a million-host sweep. It
then port-scans the range across the fleet, fingerprints the web services it
finds, checks the rest for known service issues, and grades each host A to F by
the worst thing it exposes. What comes back is a ranked exposure report rather
than a wall of open ports, which is what makes it usable for
exposure management rather than just another
scan. It is token-free and safe by default.
Pipeline
Read the input: a domain, an ASN, or a CIDR, one per line.
Normalize it to addresses. An ASN becomes its announced prefixes, a hostname
resolves to its A records over DNS-over-HTTPS, and the blast radius is
guarded: any block larger than a /16 is skipped and the target list is
capped, so a cloud ASN cannot explode the scan.
mapcidr expands the CIDRs to individual hosts, and
rustscan sweeps their ports, sharded across the fleet.
The open ports are normalized to ip:port, then httpx
fingerprints the web services and nuclei runs its network
service checks against the rest.
Each host is graded A to F by the most dangerous service it exposes, and the
ranked result is written to a report.
Inputs
Target. One domain, ASN, or CIDR per line. Point it at scope you are
authorised to scan.
Outputs
Per-host exposure. For each host: its open ports, the dangerous ones
(database, remote-access or plaintext services), and a letter grade for how
exposed it is.
Overall grade. The worst host's grade taken as the assessment's headline,
with the count of hosts exposing a dangerous service.
Report. The graded hosts and their services in one file, sorted so the
worst exposure is first.
Sample output
Illustrative, in the record shape the workflow emits. Real runs name live IPs, so
the hosts here are TEST-NET documentation addresses.
Each host is graded by its most dangerous open port, worst first:
ip
ports
risk
grade
dangerous
web
192.0.2.10
22, 443, 3306
4
F
3306
true
192.0.2.23
23, 80
4
F
23
true
192.0.2.41
443, 6379
3
D
6379
true
192.0.2.11
443
1
A
—
true
192.0.2.12
22, 443
1
A
—
true
The assessment summary is the headline grade in one line:
One input of any of three kinds: a domain, an ASN (as AS13335 or 13335), or a
CIDR. It works out which it is and resolves each to the addresses to scan, so you
do not pre-expand anything yourself.
How does it avoid scanning half the internet?
The normalize step guards the blast radius. It skips any block larger than a
/16, caps the total target list, and falls back to a reserved address if a
target resolves to nothing. Expanding a large cloud ASN therefore cannot turn
into an unbounded scan.
What does the A to F grade mean?
Each host is graded by the most dangerous service it leaves open. A database,
remote-access or plaintext protocol exposed to the internet is the worst case and
drives the grade down; a host with only a hardened web port grades well. The
assessment's overall grade is the worst host in the set.
Does it need credentials or an API key?
No. ASN lookups use a public prefix API, hostnames resolve over DNS-over-HTTPS,
and the scan itself needs no account. The whole run is token-free.
Related workflows
ASN-Wide Vulnerability Scan. Reach for this
when you want CVEs and misconfigurations across an ASN's web surface rather than
a port-and-service exposure grade.
Find Exposed Databases. Reach for this
when you specifically want databases left open, checked and confirmed, rather
than every port graded.