> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scanning policy

> How Infrawatch observes public-facing internet infrastructure

Infrawatch continuously observes public-facing internet infrastructure to provide current, first-party infrastructure intelligence.

## FAQ

<AccordionGroup>
  <Accordion title="How often does Infrawatch scan the internet?">
    Infrawatch continuously scans the public internet to keep our infrastructure intelligence fresh, current, and actionable.

    Scan frequency varies by asset type, protocol, and collection priority, with high-value and fast-changing infrastructure refreshed more frequently.
  </Accordion>

  <Accordion title="How does Infrawatch scan all ports?">
    Infrawatch scans all ports over extended periods of time as part of a long-horizon collection strategy.

    These broader scans run in parallel with our regular scanning routines, and the results help inform how frequently specific hosts, services, and protocols are revisited based on observed attributes and signal.
  </Accordion>

  <Accordion title="What are Infrawatch Scope Rules?">
    Infrawatch Scope Rules are signatures that let you classify and tag internet infrastructure across everything Infrawatch observes, in real time. They are based on the widely used YARA syntax, making them familiar and easy to work with.
  </Accordion>

  <Accordion title="Does Infrawatch use third-party sources?">
    No. Infrawatch is built on first-party collection. We generate our own data directly and do not rely on third-party feeds or enrichment providers.
  </Accordion>

  <Accordion title="How frequently will Infrawatch scan me?">
    Infrawatch uses multiple scanning tiers designed for different collection outcomes, so scan frequency varies depending on the infrastructure, protocol, and observed characteristics.

    As part of this approach:

    * Common ports across IPv4 and known IPv6 space are refreshed multiple times per day
    * Hyperscaler and bulletproof hosting infrastructure is revisited more frequently
    * Named infrastructure, particularly domains, is monitored continuously and also revalidated on a recurring basis
    * ICMP sweeps across IPv4 and known IPv6 are performed at least daily
    * Long-duration scans run across the full port range over time
  </Accordion>

  <Accordion title="Does Infrawatch support IPv6?">
    Yes. Infrawatch supports IPv6 and uses large-scale collection of active IPv6 space to help determine what we scan.
  </Accordion>

  <Accordion title="Do you support protocols on non-standard ports?">
    Yes. Infrawatch supports protocol detection on non-standard ports and is not restricted to expected port assignments.

    Where appropriate, it can attempt alternative protocol negotiations based on historical data and observed behaviour.
  </Accordion>

  <Accordion title="Where do you scan from?">
    Infrawatch scans from distributed infrastructure across North America, Europe, and Asia, using multiple vantage points to improve coverage and reduce geographic and network bias.
  </Accordion>
</AccordionGroup>