owasp-amass/amass · error

%s is not a valid IP address or range

Error message

%s is not a valid IP address or range

What it means

Set parses each whitespace/comma-separated token in an amass scope input as either an IP range (via parseRange) or a single IP (via net.ParseIP). If a token fails both, this error is returned naming the offending token. It indicates malformed scope input that is neither a CIDR-compatible range nor a valid IP literal.

Source

Thrown at config/scope.go:356

	return strings.Join(ipaddrs, ",")
}

// Set implements the flag.Value interface.
func (p *ParseIPs) Set(s string) error {
	if s == "" {
		return fmt.Errorf("IP address parsing failed")
	}

	ips := strings.Split(s, ",")
	for _, ip := range ips {
		// Is this an IP range?
		err := p.parseRange(ip)
		if err == nil {
			continue
		}
		addr := net.ParseIP(ip)
		if addr == nil {
			return fmt.Errorf("%s is not a valid IP address or range", ip)
		}
		*p = append(*p, addr)
	}
	return nil
}

func (p *ParseIPs) appendIPs(addrs []net.IP) error {
	for _, addr := range addrs {
		*p = append(*p, addr)
	}
	return nil
}

func (p *ParseIPs) parseRange(s string) error {
	twoIPs := strings.Split(s, "-")

	// If s is not a range, try parsing it as a single IP
	if twoIPs[0] == s {

View on GitHub (pinned to 79299dce87)

Solutions

1. Check the named token in your scope input and fix the typo or remove the invalid entry
2. Use only valid IP literals or 'start-end' ranges in IP scope entries; use the domains section for hostnames
3. Validate tokens with net.ParseIP or a tool like `ipcalc` before adding them to the scope

Example fix

// before
scope.Set("10.0.0.1, example.com")
// after
scope.Set("10.0.0.1") // IPs and ranges only; hostnames belong in the domains scope

for _, ip := range strings.FieldsFunc(input, func(r rune) bool { return r == ',' || r == ' ' || r == '\t' || r == '\n' }) {
	if strings.Count(ip, "-") == 0 && net.ParseIP(ip) == nil {
		return fmt.Errorf("invalid scope entry: %q", ip)
	}
}

func isValidIPToken(s string) bool { return net.ParseIP(s) != nil }

if err := scope.Set(input); err != nil {
	var bad string
	if _, err2 := fmt.Sscanf(err.Error(), "%s is not a valid IP address or range", &bad); err2 == nil {
		log.Printf("removing invalid scope token %q", bad)
	}
}

When it happens

Trigger: Calling Config.Set (or the scope population path that calls it) with a token that parseRange rejects and net.ParseIP cannot parse, e.g. '10.0.0.256', 'not-an-ip', '10.0.0.1-abc', or a stray hostname in an IP scope list.

Common situations: Hand-edited scope config files with typos, pasting domain names into an IP scope, IPv6 shorthand mistakes, or copy-paste artifacts like trailing punctuation.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• %s is not a valid IP
• invalid IP address in resolvers file: %s
• %s is not a valid IP range
• invalid key delimiter: %s
• brute forcing cannot be performed without DNS resolution

AI-assisted analysis of owasp-amass/amass@79299dce87 (2026-09-06). Data as JSON: /api/errors/c2739417d204a944. Report an issue: GitHub.