Exposed services and ports

Method

The check opens a TCP connection and closes it, 25 ports at a time with a 3-second timeout. On ports whose protocol greets first (SSH, FTP, SMTP, POP3, IMAP, MySQL, VNC), the greeting the server sends unprompted is read to identify the product and version; the scanner sends nothing. On open web and admin ports, up to 6 ordinary GET / requests do the same. That identification feeds vulnerability matching.

When every address a host resolves to belongs to a shared CDN edge (Cloudflare, CloudFront, Fastly, Akamai and similar), only the web ports 80, 443, 8080, 8443 are checked: the other ports on a shared edge answer for the provider, not for you. Ports are only compared between scans that both tried them, so a change to the list, or skipping ports on a CDN edge, never reads as a port opening or closing.

How severity is set

Severity reflects what reachability alone implies. Anything that should only ever be reached from a private network (databases, remote desktop, file shares, orchestration APIs, industrial protocols) is high; admin panels and brokers that are sometimes deliberately public are medium; services that are normal to expose but worth an inventory line are low or info. Findings use the ID fingerprint.open-port-<port>. Adjust to your context through triage: an SSH port you expose deliberately can be accepted with a review date.

Every port checked

Web

File transfer and sharing

Remote access and administration

Directory and identity

Mail

Databases and caches

Message queues and streaming

Containers, orchestration, service mesh, config management

Java and app-server internals

Monitoring agents

VPN and proxies

Industrial control and building automation

Telephony, printing, misc

Change detection

Ports opening and closing between scans appear in the change feed as port.opened and port.closed. A high-severity port that starts answering is a critical change and is sent immediately to your alert channels rather than waiting for the digest.

Extra TLS ports

Separately from this check, you can list up to 10 extra ports per domain for full certificate monitoring (for example a mail server or an admin console). See Certificates.