Vulnerabilities and exposure
Hosts and open ports
Every host a scan found, grouped by domain, with its services named by what the port means; the 128-port list; and why an empty list is not an all-clear.
Updated · 2 min read
The Hosts view answers "what is listening on the outside of my domain": every host discovery found, and for each, the TCP ports that accepted a connection and the service behind them.
Where
- Web: Security, Hosts; or a domain's Vulnerabilities module, Hosts.
- iOS: the domain's Vulnerabilities module, Hosts segment; each host opens its own findings, open ports and certificate.
- API/MCP:
GET /api/vuln-scan/assets/:domainId(hosts with finding counts),GET /api/scan/ports/:domainId(per-host port, service, banner, version, risk); toolsget_vulnerability_assets,get_open_ports.
Where hosts come from
Subdomain discovery (certificate logs and DNS) and the Subfinder pass inside a Standard or Deep scan. Each host is marked Exposed, Live or Gone, with where it was discovered and when it first turned up.
The port scan
The probe (Naabu) checks 128 TCP ports: the IANA well-known services, the cPanel and Cloudflare 20xx range, alternate-HTTP and management-console ports (8080 to 8091, 8443, 8843, 8880 and similar), databases and remote access. It is a connect test paced to stay inside a small concurrency and a fixed wall clock; it does not exploit anything. Until 2026-09-11 the list was 739 ports, most of them noise.
The port scan runs inside the Standard, Port-scan and Extreme profiles on a cleared domain, and daily on network targets.
How a port is named
The scanner's own service name wins when it read one from a banner. Otherwise the port is labelled by what the number means: 25 is SMTP, 587 SMTP submission, 3306 MySQL, 3389 RDP, 22 SSH, and so on, covering every well-known port and the registered ports a web host exposes. Each observation records the banner and version where one was read, and a risk note (a database or remote-desktop port open to the internet is flagged).
Reading the list
- Nothing here is red by itself. 80 and 443 open on a web host is correct. 3306 open on the same host is the finding.
- "A port scan has not run" is shown when there is no observation, and the evidence strip prints a dash rather than "0 risky". Before 2026-09 the tab could show a green all-clear for a scan that never ran; it cannot now.
- Each host says how much of the portfolio it rests on and names domains that have never been cleared, because a scheduled scan will not run there.
Common questions
My firewall shows no connection from the scan. The probe runs from a sandboxed container on Cloudflare's network; the source address is not fixed. Allow-listing by IP is not supported, and the scan is meant to see what the public sees.
A host shows a port my server does not have. A CDN or a load balancer in front of the host answers on the probe's behalf. The banner usually names it.
Keep reading
Related articles
- Subdomain discovery and per-host resultsHow hosts under a domain are found (certificate logs and DNS), the 100-host limit, and what each host's page shows: status, certificate, ports and findings.Domains ·Updated
- Whole-domain breach monitoringWatch every mailbox at a domain, not just the ones you name. Needs scan clearance and the paid breach index; the waitlist while a domain is being enabled.Dark web ·Updated
- The lookalike check found nothingWhat an empty result means, why it always comes with a coverage count, how to widen the check, and when a known impostor does not show up.Troubleshooting ·Updated