Port & Service Detection
Identify open network ports and exposed services across your discovered IP addresses.
Open ports are one of the most straightforward ways attackers find entry points. A database port left exposed to the public internet, an SSH server on an old IP, or an admin panel on a non-standard port: these are common and avoidable.
How it works
RiskShelter runs fast TCP probes against IP addresses discovered during the subdomain phase. It checks a curated list of ports spanning standard web traffic, remote access protocols, and high-risk services known to be frequent attack targets.
What gets flagged
| Port | Service | Why it matters |
|---|---|---|
| 22 | SSH | Remote shell (should be restricted, not open to the internet) |
| 21 / 23 | FTP / Telnet | Unencrypted legacy protocols (almost always a mistake if exposed) |
| 3389 | RDP | Frequently brute-forced; common ransomware entry point |
| 3306 / 5432 | MySQL / PostgreSQL | Database ports should never be publicly accessible |
| 6379 / 27017 | Redis / MongoDB | Often deployed without auth; critical risk if exposed |
| 8080 / 8443 / 9000 | Alt web / Admin | Staging panels, CI/CD dashboards, container management |
Service fingerprinting
When an open port is detected, RiskShelter reads the service banner and SSL handshake to identify the daemon, version, and protocol details. Version information is fed directly into the vulnerability correlation engine to check for known CVEs.
Fixing it
Close everything you don't intentionally expose. Put administrative services (SSH, RDP, internal dashboards) behind a VPN or zero-trust tunnel. Use your cloud provider's firewall rules (security groups, ACLs) to restrict inbound access to specific IP ranges.