PortSweep.io

Workflow

How PortSweep.io works

Four steps: create the company and login together, configure a target and attest, wait for the dedicated scanner when the date arrives, then read the report.

1. Create the customer and the user together

Signup creates both records in one transaction: a customer organization and an owner login. There is no separate finish-registration step and no payment capture during development.

2. Configure a scan

A scan schedule stores the target network, next run date, interval (6 or 12 months), and a stored attestation. Targets are either:

  • a comma- or newline-delimited list of public IPv4 addresses (up to 20; larger lists need a support request), or
  • a public IPv4 CIDR range of /20 or more specific (smaller). A /19 is too large. Private ranges are not accepted.

Combined host count cannot exceed 4,096. The website stores the schedule. It does not launch nmap.

3. Attest, then wait for the scanner

You must attest that you own the network or have permission to scan it. We store that statement with your account, the exact targets, the time, and your IP. That is a legal representation, not a technical ownership check. Details are on the authorization page.

When a schedule is due and attested, a separate PortSweep scanner process runs:

nmap -T3 --top-ports 1000 -sV -Pn -oX <file> <targets>
  • -Pn treats every target as up, so ICMP-blocked networks still get a port report.
  • --top-ports 1000 covers the listeners that dominate real misconfigurations (RDP, databases, admin panels, SSH, HTTPS).
  • -sV turns “443 is open” into “443 is open, nginx 1.24”.
  • -T3 is normal timing — fast enough to finish, slow enough not to look like an attack to the target’s IDS.

The scanner writes XML, parses it to JSON, and stores a report row for the console.

4. Read the report

Each report lists hosts, open ports, protocol, service name, product, and version. Failed or in-flight runs still appear in history.

What we deliberately do not do

PortSweep is not a pentest platform. Default scans do not include SYN stealth mode that needs root, OS detection, NSE vulnerability scripts, or a full 65,535-port sweep. The default answers: what common services are exposed on this attested range right now?