Can evilscan scan a whole subnet?

Yes. Use CIDR as the target, for example evilscan 198.51.100.0/24 --port=22,80,443. For very large IP/port pair counts, --hugescan lifts the default combination cap.

Does --banner grab service banners?

Yes. --banner reads what each open port announces. --bannerlen sets bytes to read (default 512). Pair with --reverse for hostnames and --geo for location tags.

Which scan methods work today?

Only tcpconnect (full handshake) is implemented. --scan also lists tcpsyn and udp upstream, but those are not implemented, so leave tcpconnect as the working choice.

evilscan or masscan for large ranges?

masscan is built for huge asynchronous sweeps. evilscan fits bounded ranges where banners, reverse DNS, and GeoIP matter in the same pass. For big fleet scans, use masscan, naabu, or evilscan-loop over a targets file.

Updated Jul 14, 2026

Network

Find open TCP ports on an IP or subnet

Node.js TCP connect scanner for a single IP or CIDR.

Scan an IP or subnet for open ports Grab banners and hostnames alongside ports Emit JSON for downstream nodes

overview

What evilscan does

Point evilscan at one IP or a CIDR and set --port to the ports or ranges to test. Default method is a full TCP connect (--scan=tcpconnect). Cap sockets with --concurrency and stall time with --timeout.

Enrich open ports with --banner, attach hostnames with --reverse, optional --geo for MaxMind location, and keep only wanted states with --status (O open, R refused, T timeout, U unreachable). Choose --display json, xml, or console.

Trickest runs evilscan as a managed Network node: target in, folder and file out. Prefer --display=json when httpx or another prober should consume the live ports next.

source github.com/eviltik/evilscan

use cases

Where evilscan fits

Scan an IP or subnet for open ports

Point evilscan at a single IP or a CIDR range with --port to find which TCP ports answer across a whole segment in one pass.

Grab banners and hostnames alongside ports

Turn on --banner, --reverse, and --geo so every open port arrives with the service banner, a reverse-DNS hostname, and a GeoIP location, not a bare port number.

Emit JSON for downstream nodes

Set --display=json so open ports feed cleanly into an httpx or nuclei stage instead of staying as console text.

Tune throughput for a bounded range

Adjust --concurrency and --timeout to balance speed against accuracy on flaky hosts, and use --status to keep only the port states you care about.

reference

evilscan inputs and flags

14 inputs

Name	Type	Flag	Description
ip-address-or-subnet	STRING	·	IP address or subnet to scan (positional target).
ports	STRING	--port	Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.
scan-method	STRING	--scan	Scan method: tcpconnect (full connect, default).
status	STRING	--status	Port states to include: T timeout, R refused, O open (default), U unreachable.
concurrency	STRING	--concurrency	Maximum number of simultaneous sockets open (default 500).
timeout	STRING	--timeout	Maximum milliseconds before closing a connection (default 2000).
banner	BOOLEAN	--banner	Grab and display the service banner for each open port.
result-format	STRING	--display	Result output format: json, xml, or console.

Showing key inputs. evilscan exposes 14 inputs in total.

Full flag reference (14 inputs)

Name	Type	Flag	Description
geoip	BOOLEAN	--geo	Display a GeoIP location for each result (free MaxMind data).
ports	STRING	--port	Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.
banner	BOOLEAN	--banner	Grab and display the service banner for each open port.
status	STRING	--status	Port states to include in results: T timeout, R refused, O open (default), U unreachable.
timeout	STRING	--timeout	Maximum milliseconds before closing a connection (default 2000).
hugescan	BOOLEAN	--hugescan	Allow an IP/port combination count greater than 16,580,355.
progress	BOOLEAN	--progress	Display a progress indicator every second.
valid-dns	BOOLEAN	--reversevalid	Only display results with a valid reverse DNS, unless ports are specified.
concurrency	STRING	--concurrency	Maximum number of simultaneous sockets open (default 500).
scan-method	STRING	--scan	Scan method: tcpconnect (full connect, default). tcpsyn and udp are listed but not yet implemented.
banner-length	STRING	--bannerlen	Number of banner bytes to grab (default 512).
result-format	STRING	--display	Result output format: json, xml, or console.
display-dns-lookup	BOOLEAN	--reverse	Display the reverse DNS lookup for each host.
ip-address-or-subnet	STRING	·	IP address or subnet to scan (positional target).

example

Run evilscan

evilscan · command

# TCP connect sweep of a subnet, grab banners, emit JSONevilscan 198.51.100.0/24 --port=22,80,443,8080 --banner --reverse --display=json

sample output

{"ip":"198.51.100.10","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu"}{"ip":"198.51.100.10","port":80,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.10","port":443,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.23","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_9.6"}{"ip":"198.51.100.23","port":8080,"status":"open","banner":"gunicorn/21.2.0"}{"ip":"198.51.100.42","port":443,"status":"open","banner":"Apache/2.4.57"}{"ip":"198.51.100.77","port":22,"status":"open","banner":""}

guidance

Choosing evilscan

Use evilscan for a bounded TCP connect sweep of an IP or subnet when you also want banners, reverse DNS, or GeoIP in one pass. For internet-scale volume, prefer masscan or naabu.

masscan

Asynchronous internet-scale port scanner. Faster on huge ranges; evilscan stays simpler when you want banners and reverse DNS together.

naabu

Fast Go port scanner built for recon pipelines. Sibling for the same open-port discovery role.

faq

evilscan questions

Pass the IP as the positional target and ports with --port, for example evilscan 198.51.100.10 --port=1-1000. On Trickest, set the ip-address-or-subnet and ports inputs.

Run evilscan yourself

A subnet feeds evilscan, which sweeps it for open ports and passes the results to httpx so live services land as a queryable output.

Run evilscan in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

ip-address-or-subnet

STRING

IP address or subnet to scan (positional target).

ports

STRING

--port

Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.

scan-method

STRING

--scan

Scan method: tcpconnect (full connect, default).

status

STRING

--status

Port states to include: T timeout, R refused, O open (default), U unreachable.

concurrency

STRING

--concurrency

Maximum number of simultaneous sockets open (default 500).

timeout

STRING

--timeout

Maximum milliseconds before closing a connection (default 2000).

banner

BOOLEAN

--banner

Grab and display the service banner for each open port.

result-format

STRING

--display

Result output format: json, xml, or console.

Name

Type

Flag

Description

geoip

BOOLEAN

--geo

Display a GeoIP location for each result (free MaxMind data).

ports

STRING

--port

Port(s) or ranges to scan, e.g. --port=21,22,23,5900-5902.

banner

BOOLEAN

--banner

Grab and display the service banner for each open port.

status

STRING

--status

Port states to include in results: T timeout, R refused, O open (default), U unreachable.

timeout

STRING

--timeout

Maximum milliseconds before closing a connection (default 2000).

hugescan

BOOLEAN

--hugescan

Allow an IP/port combination count greater than 16,580,355.

progress

BOOLEAN

--progress

Display a progress indicator every second.

valid-dns

BOOLEAN

--reversevalid

Only display results with a valid reverse DNS, unless ports are specified.

concurrency

STRING

--concurrency

Maximum number of simultaneous sockets open (default 500).

scan-method

STRING

--scan

Scan method: tcpconnect (full connect, default). tcpsyn and udp are listed but not yet implemented.

banner-length

STRING

--bannerlen

Number of banner bytes to grab (default 512).

result-format

STRING

--display

Result output format: json, xml, or console.

display-dns-lookup

BOOLEAN

--reverse

Display the reverse DNS lookup for each host.

ip-address-or-subnet

STRING

IP address or subnet to scan (positional target).

{"ip":"198.51.100.10","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu"}{"ip":"198.51.100.10","port":80,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.10","port":443,"status":"open","banner":"nginx/1.24.0"}{"ip":"198.51.100.23","port":22,"status":"open","banner":"SSH-2.0-OpenSSH_9.6"}{"ip":"198.51.100.23","port":8080,"status":"open","banner":"gunicorn/21.2.0"}{"ip":"198.51.100.42","port":443,"status":"open","banner":"Apache/2.4.57"}{"ip":"198.51.100.77","port":22,"status":"open","banner":""}

Find open TCP ports on an IP or subnet

What evilscan does

Where evilscan fits

Scan an IP or subnet for open ports

Grab banners and hostnames alongside ports

Emit JSON for downstream nodes

Tune throughput for a bounded range

evilscan inputs and flags

Run evilscan

Choosing evilscan

masscan

naabu

evilscan questions

More Network tools

asnmap

dnsvalidator

fping

httprobe

httpx

mapcidr

Run evilscan yourself

Find open TCP ports on an IP or subnet

What evilscan does

Where evilscan fits

Scan an IP or subnet for open ports

Grab banners and hostnames alongside ports

Emit JSON for downstream nodes

Tune throughput for a bounded range

evilscan inputs and flags

Run evilscan

Choosing evilscan

masscan

naabu

evilscan questions

More Network tools

asnmap

dnsvalidator

fping

httprobe

httpx

mapcidr

Run evilscan yourself