Troubleshooting

The scan was refused before it started#

CGNAT or mobile carrier range. The address is shared, so scanning it would touch hosts that are not yours. Run the command on the server itself rather than a laptop on mobile tethering.
IPv6 connection. Scanning is IPv4 only. Force IPv4 with curl -4 https://qsa.sh.
Proxy, VPN or Tor origin. Disconnect the tunnel, or run from the host directly.

The scan found no open ports#

That is a valid and good result. It means nothing in the scanned port range answered from outside. Confirm the IP printed at the start of the scan is the host you meant to check. If you are behind a load balancer or a proxy, the connecting IP may not be the machine you had in mind.

A finding looks wrong#

CVE matches come from the version banner nmap detected. Backported security patches often leave the banner unchanged, so a patched service can still match an old CVE. Verify against your package version before treating it as urgent, and report clear false positives through qsa.sh/contact.

I hit a rate limit#

Free is one scan per IP per 24 hours. If you are in a fix and verify loop, Full Pro allows hourly scans. See Scan tiers.

The scan is taking longer than advertised#

Times are typical, not guaranteed. More open ports, higher latency and more matching checks all extend a run. Deep in particular runs 13 to 16 minutes and is delivered by email rather than a held connection.