I have no idea about the specifics for SP10, nor what you mean by 'advanced ip scanner', but the best way I know to discover a device IP address, no matter what the subnet is and even if it's statically configured, is the good old tcpdump:
# tcpdump -iarp
Best results if you plug it back to back on a dedicated interface, bringing the PHY link up and down (i.e. plug/unplug the cable). Of course it assumes that the device will send at least one packet for an ARP request to be made, but in my real world experience, it's much more efficient than IP scanners that are generally limited to the scope of your LAN subnet.
Then of course, if the address originating the ARP request is outside the subnet, you'll need to reconfigure your host address and/or change the subnet to 0.0.0.0 before you can reach it on layer 3+