Can evilscan scan a whole subnet or IP range?

Yes. Give it CIDR notation as the target, e.g. `evilscan 198.51.100.0/24 --port=22,80,443`. It walks every host in the range. For a very large number of IP/port pairs, --hugescan lifts the default cap of 16,580,355 combinations.

Does evilscan grab service banners?

Add --banner and each open port reports what the service announces. --bannerlen sets how many bytes to read (default 512). Pair it with --reverse for hostnames and --geo for a GeoIP location on each result.

What scan method does evilscan use?

A full TCP connect scan (--scan=tcpconnect), which completes the handshake. The tcpsyn half-open and udp methods are listed but not yet implemented upstream, so tcpconnect is the working option.

What output formats does evilscan support?

JSON, XML, or console text via --display. Choose --display=json to hand structured records to the next node; console is the human-readable default. The --status filter controls which port states (open, refused, timeout, unreachable) reach the output.

evilscan or masscan for large scans?

masscan is an asynchronous, internet-scale scanner and is far faster across millions of hosts. evilscan is the simpler Node.js option for bounded ranges where you also want banner grabbing, reverse DNS, and GeoIP context in the same pass. For huge sweeps, reach for masscan or naabu instead.

Updated Jul 14, 2026

Network

Scan an IP address or subnet for open ports

A simple Node.js network scanner.

Scan an IP or subnet for open ports Grab banners and hostnames alongside ports Emit JSON for downstream nodes

overview

What evilscan does

evilscan sweeps an IP address or a subnet for open ports using a full TCP connect scan. Written in Node.js, it covers the everyday port-sweep needs: choose the ports or ranges to test with --port, set how many sockets run at once with --concurrency, and bound each connection with --timeout so a slow host does not stall the run.

It adds context to a plain open-port list. Banner grabbing reads what a service announces, reverse DNS resolution attaches hostnames, optional GeoIP tags each result with a location, and a status filter keeps only the port states you want. Results come out as JSON, XML, or console text via --display so they slot into the next stage.

On Trickest, evilscan is a Network node that takes an IP address or subnet and writes a folder and a file. Run it to find open ports across a range, emit JSON, and pass the live services to a probing or scanning stage downstream.

source github.com/eviltik/evilscan

use cases

Where evilscan fits

Scan an IP or subnet for open ports

Point evilscan at a single IP or a CIDR range with --port to find which TCP ports answer across a whole segment in one pass.

Grab banners and hostnames alongside ports

Turn on --banner, --reverse, and --geo so every open port arrives with the service banner, a reverse-DNS hostname, and a GeoIP location, not a bare port number.

Emit JSON for downstream nodes

Set --display=json so open ports feed cleanly into an httpx or nuclei stage instead of staying as console text.

Tune throughput for a bounded range

Adjust --concurrency and --timeout to balance speed against accuracy on flaky hosts, and use --status to keep only the port states you care about.

reference

evilscan inputs and flags

14 inputs

Name	Type	Flag	Description
ip-address-or-subnet	STRING	·	IP address or subnet to scan (positional target).
ports	STRING	--port	Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.
scan-method	STRING	--scan	Scan method: tcpconnect (full connect, default).
status	STRING	--status	Port states to include: T timeout, R refused, O open (default), U unreachable.
concurrency	STRING	--concurrency	Maximum number of simultaneous sockets open (default 500).
timeout	STRING	--timeout	Maximum milliseconds before closing a connection (default 2000).
banner	BOOLEAN	--banner	Grab and display the service banner for each open port.
result-format	STRING	--display	Result output format: json, xml, or console.

Showing key inputs. evilscan exposes 14 inputs in total.

Full flag reference (14 inputs)

Name	Type	Flag	Description
geoip	BOOLEAN	--geo	Display a GeoIP location for each result (free MaxMind data).
ports	STRING	--port	Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.
banner	BOOLEAN	--banner	Grab and display the service banner for each open port.
status	STRING	--status	Port states to include in results: T timeout, R refused, O open (default), U unreachable.
timeout	STRING	--timeout	Maximum milliseconds before closing a connection (default 2000).
hugescan	BOOLEAN	--hugescan	Allow an IP/port combination count greater than 16,580,355.
progress	BOOLEAN	--progress	Display a progress indicator every second.
valid-dns	BOOLEAN	--reversevalid	Only display results with a valid reverse DNS, unless ports are specified.
concurrency	STRING	--concurrency	Maximum number of simultaneous sockets open (default 500).
scan-method	STRING	--scan	Scan method: tcpconnect (full connect, default). tcpsyn and udp are listed but not yet implemented.
banner-length	STRING	--bannerlen	Number of banner bytes to grab (default 512).
result-format	STRING	--display	Result output format: json, xml, or console.
display-dns-lookup	BOOLEAN	--reverse	Display the reverse DNS lookup for each host.
ip-address-or-subnet	STRING	·	IP address or subnet to scan (positional target).

example

Run evilscan

evilscan · command

# TCP connect sweep of a subnet, grab banners, emit JSONevilscan 198.51.100.0/24 --port=22,80,443,8080 --banner --reverse --display=json

sample output

{"ip":"198.51.100.10","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu"}{"ip":"198.51.100.10","port":80,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.10","port":443,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.23","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_9.6"}{"ip":"198.51.100.23","port":8080,"status":"open","banner":"gunicorn/21.2.0"}{"ip":"198.51.100.42","port":443,"status":"open","banner":"Apache/2.4.57"}{"ip":"198.51.100.77","port":22,"status":"open","banner":""}

guidance

Choosing evilscan

Use evilscan for a straightforward TCP connect port sweep of an IP or subnet with banner and reverse-DNS context. For very large, high-speed internet-scale scanning, a tool like masscan is faster. evilscan is the simple, scriptable Node.js option for bounded ranges.

masscan

Asynchronous internet-scale port scanner. Far faster for huge ranges; evilscan is simpler with banner and reverse-DNS extras.

naabu

Fast Go port scanner built for recon pipelines. A sibling for the same port-sweep role.

faq

evilscan questions

Pass the target IP as the first argument and the ports with --port, e.g. `evilscan 198.51.100.10 --port=1-1000`. On Trickest, set the node's IP-address-or-subnet input and the --port input instead of typing the command.

Run evilscan yourself

A subnet feeds evilscan, which sweeps it for open ports and passes the results to httpx so live services land as a queryable output.

Run evilscan in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

ip-address-or-subnet

STRING

IP address or subnet to scan (positional target).

ports

STRING

--port

Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.

scan-method

STRING

--scan

Scan method: tcpconnect (full connect, default).

status

STRING

--status

Port states to include: T timeout, R refused, O open (default), U unreachable.

concurrency

STRING

--concurrency

Maximum number of simultaneous sockets open (default 500).

timeout

STRING

--timeout

Maximum milliseconds before closing a connection (default 2000).

banner

BOOLEAN

--banner

Grab and display the service banner for each open port.

result-format

STRING

--display

Result output format: json, xml, or console.

Name

Type

Flag

Description

geoip

BOOLEAN

--geo

Display a GeoIP location for each result (free MaxMind data).

ports

STRING

--port

Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.

banner

BOOLEAN

--banner

Grab and display the service banner for each open port.

status

STRING

--status

Port states to include in results: T timeout, R refused, O open (default), U unreachable.

timeout

STRING

--timeout

Maximum milliseconds before closing a connection (default 2000).

hugescan

BOOLEAN

--hugescan

Allow an IP/port combination count greater than 16,580,355.

progress

BOOLEAN

--progress

Display a progress indicator every second.

valid-dns

BOOLEAN

--reversevalid

Only display results with a valid reverse DNS, unless ports are specified.

concurrency

STRING

--concurrency

Maximum number of simultaneous sockets open (default 500).

scan-method

STRING

--scan

Scan method: tcpconnect (full connect, default). tcpsyn and udp are listed but not yet implemented.

banner-length

STRING

--bannerlen

Number of banner bytes to grab (default 512).

result-format

STRING

--display

Result output format: json, xml, or console.

display-dns-lookup

BOOLEAN

--reverse

Display the reverse DNS lookup for each host.

ip-address-or-subnet

STRING

IP address or subnet to scan (positional target).

{"ip":"198.51.100.10","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu"}{"ip":"198.51.100.10","port":80,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.10","port":443,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.23","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_9.6"}{"ip":"198.51.100.23","port":8080,"status":"open","banner":"gunicorn/21.2.0"}{"ip":"198.51.100.42","port":443,"status":"open","banner":"Apache/2.4.57"}{"ip":"198.51.100.77","port":22,"status":"open","banner":""}

Scan an IP address or subnet for open ports

What evilscan does

Where evilscan fits

Scan an IP or subnet for open ports

Grab banners and hostnames alongside ports

Emit JSON for downstream nodes

Tune throughput for a bounded range

evilscan inputs and flags

Run evilscan

Choosing evilscan

masscan

naabu

evilscan questions

More Network tools

asnmap

bass

decant

decant-file

dnsvalidator

dnsvalidator-patch

Run evilscan yourself

Scan an IP address or subnet for open ports

What evilscan does

Where evilscan fits

Scan an IP or subnet for open ports

Grab banners and hostnames alongside ports

Emit JSON for downstream nodes

Tune throughput for a bounded range

evilscan inputs and flags

Run evilscan

Choosing evilscan

masscan

naabu

evilscan questions

More Network tools

asnmap

bass

decant

decant-file

dnsvalidator

dnsvalidator-patch

Run evilscan yourself