[ scanner ]

About the Hostmetry scanner

If you found Hostmetry in your firewall or web server logs, this page explains what that traffic is, why it is harmless, and how to stop it if you prefer.

What Hostmetry is

Hostmetry is an internet measurement and security research platform. We periodically check publicly routable IP addresses to learn which services are reachable from the internet, and make that information searchable for security teams, researchers and network owners — so that exposed systems are found and fixed by defenders, not just by attackers.

What the scanner does

• Sends a connection request (TCP SYN, or a standard UDP probe) to a set of common ports.
• If a port answers, completes the ordinary protocol handshake — for example a TLS handshake or an HTTP GET / — exactly as a normal client would.
• Records the publicly returned information: service banner, protocol and software version, TLS certificate, HTTP headers and page title.

What the scanner never does

• Never attempts to log in, guess or brute-force credentials.
• Never exploits vulnerabilities or sends attack payloads.
• Never tries to access non-public paths, files or data.
• Never changes the state of a system, submits forms or writes data.
• Never sends enough traffic to affect a host’s availability — probes to any single address are spread out over time.

How to identify our traffic

• Source addresses: only the ranges listed below.
• Reverse DNS: every scanner address resolves to a hostname under a Hostmetry-controlled domain, which will be listed here.
• HTTP User-Agent: Mozilla/5.0 (compatible; HostmetryScanner/1.0; +https://hostmetry.com/scanner)
• A web page on each scanner IP: opening any scanner address in a browser leads back to this page.

Scanner IP addresses

No addresses are in use yet. When scanning begins, the full list will be kept up to date here and at:

• /scanner/ips.txt — one CIDR per line, for firewalls and allowlists
• /scanner/ips.json — JSON with ranges and the last update time

How to opt out

You can exclude any network you are responsible for. Two options, use whichever is easier:

1. Ask us: follow the instructions on the opt-out page. We exclude your ranges within 72 hours and keep them excluded.
2. Block us: drop traffic from the ranges in ips.txt at your firewall.

Note that opting out only removes your network from Hostmetry. Other parties — including malicious ones — scan the internet continuously and will still see your exposed services.

Reporting a problem

If you believe our scanner caused a problem, or you want to report misuse of Hostmetry data, write to abuse@hostmetry.com. Please include the source IP, the time with time zone, and the destination address if possible. We reply to every report within one business day.

Security vulnerabilities in Hostmetry itself go to security@hostmetry.com (see our security.txt).