Use cases

External inventory

DNS, CMDB, and cloud consoles disagree. An external scan of a /24 you control is the ground truth for “what is actually answering.” Especially useful after a datacenter move, a firewall rebuild, or when a contractor left six months ago.

Change detection

Two reports, six months apart, make drift obvious: a new RDP listener, a database port that appeared after a “temporary” rule, a VPN concentrator that was decommissioned in the wiki but not on the wire. Service versions in the same report turn “still on 443” into “still on 443, but the build aged.”

Onboarding a network block

When you inherit a range — acquisition, new ISP allocation, leftover from a prior vendor — a first authorized scan is a safe way to list live hosts before you start shutting things off.

Paper trail

ISPs and cloud providers investigate unsolicited scan traffic. PortSweep stores the attestation for the scan: account, exact targets, time, and request IP. If a SOC emails about probes from our scan node, you can point at the schedule and that record.

What PortSweep is not for

• Scanning ranges you do not own or have in writing to test
• Bug-bounty recon against third-party assets
• Continuous 24×7 port monitoring (this is a scheduled report, not an uptime product)
• Internal east-west mapping of RFC1918 from outside the perimeter — those addresses will not answer the way you expect from an internet scan node