Our scans
This page describes Range Zero’s scanner: what it does, how to recognise it in your logs, and how to ask it to stop analysing your domains. The domain range-zero.net is used only to identify the scanner, and this page is the full version of its information page.
What the scanner does
The scanner is used by Atlas. It runs checks from the Internet, on the only domains entrusted to it:
- public DNS resolution;
- lookups in public Certificate Transparency logs;
- for domains whose ownership has been verified, a check of a list of common ports and identification of the services that respond.
Intrusive, fuzzing and denial-of-service checks are excluded by default. The scanner does not send any payload intended to interrupt a service.
Verified domains only
No active check is run on a domain whose ownership has not been verified. Ownership is verified with a DNS TXT record: create _rangezero. followed by your domain name (for example _rangezero.example.com) and give it the value the application shows you, in the form rangezero-verification=<token>. The domain stays unverified until the record is found, and the check can be run again at any time.
How to recognise our requests
- User-agent:
RangeZero-Atlas/<version> (+https://range-zero.net). The version is the scanner version published with each update. - Source IP addresses: they are not fixed yet. They will be published on this page before production.
- Reverse DNS: the source addresses will have reverse names under
range-zero.net, published with the address list. - Pre-production: before production, the scanner only processes test targets and Cardinal Codes domains.
Report abuse or request an opt-out
For any question, complaint or opt-out request, write to abuse@range-zero.com.
- Give the domain concerned, your organisation’s name and your link to that domain.
- We check that the request comes from the domain holder or a person authorised to act for them.
- Once the request is verified, we stop analysing that domain and delete the results concerning it.
An opt-out request does not need to demonstrate a vulnerability: showing the link to the domain is enough.