Target detection and safeguards

The target is always your connecting IP#

Origins that are refused#

• Known CGNAT ranges. The address is shared with other customers, so scanning it would hit hosts that are not yours.
• Mobile carrier addresses. Same reason.
• IPv6. Scanning is IPv4 only.
• Detected proxy, VPN or Tor origins. Best effort detection, IPv4 only.

The abort window#

Before any packet is sent to your host you get a 15 second window to press Ctrl-C. Nothing has been scanned at that point. Letting the countdown finish is your affirmation that you are authorized to scan the host at that address.

The animated terminal on the qsa.sh homepage shows a condensed countdown for display purposes. The real window is the full 15 seconds.

Time bounding#

Every scan is hard capped in duration and self terminates. If your connection drops, the scan is cancelled as soon as the disconnect is detected, rather than continuing without a listener.

Next#

• Acceptable use
• Data retention
• Back to the index