Scanner Policy

What We Scan

Shadow Span is a unified security platform. We operate three categories of outbound active scanning, and we’re explicit about all of them:

• EASM — customer-registered domains. Subdomain enumeration, port and service discovery, TLS and HTTP fingerprinting, and CVE correlation against assets a customer has explicitly registered as their own attack surface.
• Supply chain — vendor risk. Banner-grade probes of third-party vendor surfaces that customers monitor as part of their vendor risk program. This is the same model that Censys, Shodan, BitSight, and SecurityScorecard operate under: public-observable signal only.
• Intelligence feeds. Read-only HTTP fetches of public CVE, threat-actor, IOC, and certificate transparency sources. No probing.

What We Don’t Do

Shadow Span is a passive-grade external scanner. We do not, and will not:

• Send exploit payloads of any kind
• Attempt credential brute-force or password spraying
• Issue requests that match common WAF exploit signatures
• Run at rates that could cause denial of service
• Use deceptive or browser-impersonating User-Agents
• Probe systems or address space we have been asked to exclude
• Attempt to access data that is not publicly served
• Collect personal data from the surfaces we observe

How We Identify Ourselves

Every outbound HTTP request from a Shadow Span scanner carries the same canonical User-Agent. Format follows the Censys and Shodan convention ofProduct/Version (+policy-url)so receiving operators can identify the scan, follow the URL back to this page, and reach us at abuse@shadowspan.com.

ShadowSpan-Scanner/1.0 (+https://shadowspan.com/scanning)

We also set an RFC 7231 From: header of abuse@shadowspan.com on every request, so you don’t have to follow the URL to find us.

Source IP Ranges

All scanning runs from Google Cloud in the us-east4 region. Every scanner that reaches your infrastructure, or a third party’s on your behalf, sends from one static address — so you can allowlist a single IP and cover all of it:

• Attack surface (EASM) — discovery and assessment of your internet-facing assets.
• Application security testing (DAST) — passive and active web scans, run only against targets you have registered.
• Vendor risk — assessment of your suppliers’ public posture.

A small number of scanners do not probe customer or vendor infrastructure and are deliberately not on that address. Cloud posture checks read your cloud provider’s API with credentials you grant us — authenticated API calls, not network probing. Phishing analysis fetches attacker-controlled sites, and brand monitoring reads public social platforms; both use Cloud Run’s dynamic egress pool, which is Google-owned space but is not limited to the published us-east4 ranges in Google’s cloud.json, so an allowlist built from that file will not match them. None of them will contact your infrastructure. The User-Agent above always identifies our traffic as ours.

Frequency & Rate

We rate-limit at the scanner tier, not at the network tier. Per-host caps:

Customer-triggered on-demand scans honour the same per-host cap. We do not offer a “fast mode” that bypasses it.

Opt-Out & Exclusion

Any IP-range owner can request exclusion. Email abuse@shadowspan.com with the IP range or domain you control and a way for us to verify ownership (WHOIS record, RIR contact, or a DNS TXT record we can check). We confirm exclusion within one business day and propagate it to every Shadow Span scanner.

Request Exclusion

Exclusion is permanent and free. We don’t require a reason. If a customer later registers an excluded surface as their own, we’ll verify ownership with both parties before re-enabling.

Legal Posture

Shadow Span operates under the same legal model as Censys, Shodan, and BitSight. External attack-surface monitoring (EASM) and vendor-risk scanning are both limited to public-observable signal that any internet user could collect — DNS and certificate-transparency records, TLS handshakes, HTTP responses, and third-party scan data. We do not port-scan or version-probe hosts. EASM runs only on domains a customer has attested it owns or is authorized to monitor; that attestation is recorded with the accepting user, time and wording. Active security testing (DAST) is a separate engagement that requires DNS-verified proof of domain ownership before any attack payload is sent. We never run exploit tests against any system without that verified authorization.

We comply with the U.S. Computer Fraud and Abuse Act (no unauthorized access), the Canadian Criminal Code section 342.1 and PIPEDA (no unauthorized use of a computer; no collection of personal information from observed surfaces), and EU GDPR (we do not collect personal data from external scanning).

Contact

Our coordinated-disclosure policy is published at /.well-known/security.txt.