# masscan excludefile — never probe these ranges.
# RFC1918 private + loopback + link-local + multicast + documentation/bogons.
# The service refuses to start if this file is missing (fail closed).

# Loopback
127.0.0.0/8

# RFC1918 private
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

# Link-local
169.254.0.0/16

# CGNAT (RFC 6598)
100.64.0.0/10

# Multicast + reserved
224.0.0.0/4
240.0.0.0/4

# Documentation / benchmark / example ranges (never real hosts)
0.0.0.0/8
192.0.2.0/24
198.51.100.0/24
203.0.113.0/24
192.0.0.0/24
198.18.0.0/15
255.255.255.255/32

# Carrier NAT / TEST-NET leftovers
233.252.0.0/24