Hosts and open ports

The Hosts view answers "what is listening on the outside of my domain": every host discovery found, and for each, the TCP ports that accepted a connection and the service behind them.

Where

• Web: a domain's page, Hosts and software: every host on the domain with the software and version each runs, hosts with a confirmed advisory first, each with Check again. Security, Vulnerability scan for the hosts the last scan covered; Security, Overview, Exposed network services for every domain.
• iOS: the domain's Vulnerabilities module, Hosts; each host opens its own findings, open ports and certificate. Monitoring, Software, Advisories, hosts and network targets, Hosts lists every domain's hosts.
• API/MCP: GET /api/vuln-scan/assets/:domainId (hosts with finding counts), GET /api/scan/ports/:domainId (per-host port, service, banner, version, risk); tools get_vulnerability_assets, get_open_ports.

Where hosts come from

Subdomain discovery (certificate logs and DNS) and the Subfinder pass inside a Standard or Deep scan. Each host is marked Exposed, Live or Gone, with where it was discovered and when it first turned up.

The port scan

The probe checks 134 TCP ports: the IANA well-known services, the cPanel and Cloudflare 20xx range, alternate-HTTP and management-console ports (8080 to 8091, 8443, 8843, 8880 and similar), databases, remote access, and the two UniFi controller ports (6789 and 11443). It is a connect test paced to stay inside a small concurrency and a fixed wall clock; it does not exploit anything. Until 2026-09-11 the list was 739 ports, most of them noise.

The port scan runs inside the Standard, Port-scan and Extreme profiles on a verified domain, and about once a day on network targets.

Where the scan comes from

Since 2026-09-30 port scans come from our own server at 107.173.3.11. If your firewall or IDS allowlists scanners, that is the address to add. When that server is busy or down, the scan runs from Cloudflare's network instead, which has no fixed address. Each open port gets one polite read: a web request with User-Agent: DomainGuard-BannerProbe/1.0, or the SSH greeting as SSH-2.0-DomainGuard_BannerProbe. No logins are tried. The finding's evidence names which scanner ran.

A subdomain that points to a service another company runs (an email provider's link tracker, Microsoft 365, a Shopify store and similar) is not port-scanned: the machines behind it belong to that company, and you can only authorise scans of your own. The scan lists the hosts it left out.

How a port is named

The scanner's own service name wins when it read one from a banner. Otherwise the port is labelled by what the number means: 25 is SMTP, 587 SMTP submission, 3306 MySQL, 3389 RDP, 22 SSH, and so on, covering every well-known port and the registered ports a web host exposes. Each observation records the banner and version where one was read, and a risk note (a database or remote-desktop port open to the internet is flagged).

Reading the list

• Nothing here is red by itself. 80 and 443 open on a web host is correct. 3306 open on the same host is the finding.
• "A port scan has not run" is shown when there is no observation, and the evidence strip prints a dash rather than "0 risky". Before 2026-09 the tab could show a green all-clear for a scan that never ran; it cannot now.
• Each host says how much of the portfolio it rests on and names domains that have never been verified, because no port scan runs there.

New admin services

When a host starts answering on an admin, remote-access or database port (SSH, Remote Desktop, VNC, cPanel or WHM, a UniFi controller, Synology, MySQL, PostgreSQL, Redis and similar), you get a "New admin service exposed" alert under the Security issues switch. Because the port scan misses ports now and then, the service has to answer on two scans of the host in a row, and three earlier scans of the host must all have been without it; a host's first scans are its baseline. It is compared by service, not port (cPanel answering on 2082 one day and 2083 the next is the same cPanel), and a port that was already open before the scanner learned to name it is not new. Cloudflare's edge, which answers the cPanel and alternate HTTPS ports for every proxied site, is ignored. Each port is announced once a year at most.

Check again

Check again on a host (a domain's page, in its banner or under Hosts and software; the same button in the app) re-reads that host's software now rather than at the next scheduled pass. It reads the public web pages; software on other ports is re-read by the next vulnerability scan, and the answer says so. When the version moved out of an advisory's range the alert closes and a "Fixed" alert says what changed. Free accounts get one per host per day; the answer says when the allowance is used. (POST /api/domains/:id/hosts/recheck.)

Common questions

My firewall shows no connection from the scan. Look for 107.173.3.11, the address port scans normally come from. When that server is busy or down the scan runs from Cloudflare's network instead, which has no fixed address, so a firewall rule cannot cover every scan. The scan is meant to see what the public sees, so an allowlist is optional.

A host shows a port my server does not have. A CDN or a load balancer in front of the host answers on the probe's behalf. The banner usually names it.