No, no hairpinning allowed. If you try to scan a 192.168.x.x or 10.x.x.x
network without actually being on the proper network yourself, your scan
requests will go out to your default gateway where it will simply be
dropped.

When "net route add" is used is it forever or is the setting lost on next boot ?

What I think might be happening concerning this scanning of 10.x.x.x

10.x.x.x is one big subnet.

The modem's ip is within 10.x.x.x range.

So it seems to make perfect sense to be able to query other modems and itself even on this subnet.

Though maybe setting my PC to IP 10.x.x.x could be a nice track to communicate with this modem ?

Though perhaps 10.x.x.x is only allowed/recognized if it comes over coax... not sure about that.

Basically the modem doesn't seem to know that it's ip is 10.x.x.x so this is why traffic is simply forwarded to some router or device on 10.x.x.x which somehow sends something back to the modem... maybe an ARP or something...

or perhaps TCP connections to 10.x.x.x.

This is what the port scanner seems to be doing... it's trying to find a tcp port on these cable modems...

Somehow it must be working for some of them... seems to work for most regions if not all, but at least south part of country... some parts didn;t show 10.x.x.x in trace route but that depends on router configs... the 10.x.x.x seems to be used for many modems in many regions.

It's thread from 2012 though, maybe some stuff has changed.

Theoretically you'll have to find an explanation why it worked, since it worked for them

Bye,
Skybuck.