Tohou scanning policy.
Tohou measures publicly reachable internet services to build security intelligence for defenders. Collection is limited to unauthenticated, non-state-changing protocol handshakes and metadata.
What our scanners do
Scanner agents connect to selected public ports, identify supported protocols, collect bounded banners and certificate metadata, and disconnect. They do not attempt authentication, brute force, exploitation, persistence, or evasion.
How scanners identify themselves
HTTP requests use an identifiable Tohou scanner user agent. Scanner source addresses use descriptive reverse DNS where supported. This page and the abuse contact below remain the authoritative identity for scanner traffic.
Rate limits and exclusions
Campaigns enforce global and per-prefix limits, mandatory special-use exclusions, operator-maintained blocklists, and a global emergency stop. Exclusions are synchronized to workers before network activity begins.
Opt out
Network operators may request exclusion of an address or CIDR. Include the affected range and proof that you are authorized to make the request.
[email protected]