Host is down and then up with different ip

Hello, everyone

I need some consultation about nmap scan for the host with cloud-based technology.
The project is hosted with Amazon.
I have decided to check all ports not only “interesting” and common but uncommon too. And started to scan with nmap ports by 30 every request for convenience.

Steps To Reproduce:

  1. nmap -sV -vv ip_address -p300-330
  2. nmap -sV -vv ip_address -p331-340
  3. nmap -sV -vv ip_address -p341-370
  4. nmap -sV -vv ip_address -p371-400

Actual Result:
After that host is down for about one minute.
Then domain changes it’s IP address.


  1. Is it was like dDos for the host and changes ip is like security from Amazon?
  2. Should it be like that?

Thank you

Yes, nowadays servers have the capability of blocking some IP performing nmap scans and maybe changing the IPs also. That’s why by default nmap performs scan on common ports only.

@Apurv-StationX, thank you for your answer.