Port Scanner

A TCP port is simply an address on a host where a service can listen — one machine, thousands of possible doors. When a scanner probes a port, three outcomes are possible: open means a service completed the TCP handshake and is accepting connections; closed means the host answered with a reset, so nothing is listening but the host itself is reachable; filtered means no answer came back at all, which almost always indicates a firewall silently dropping the probe. Reading a scan is therefore less about the individual ports and more about the overall picture: what did you intend to expose, and does the scan match that intent?

The findings that matter most are database and admin services listening on public interfaces. Redis, MongoDB, MySQL, PostgreSQL, and RDP were all designed to sit on trusted internal networks, and several of them historically shipped with no authentication enabled by default. Publicly exposed Redis and MongoDB instances have been mass-compromised in repeated waves — data wiped, held for ransom, or quietly exfiltrated — precisely because internet-wide scanning makes every exposed instance discoverable within hours. An open database port on a public IP is rarely a deliberate choice; it is usually a security group edited in a hurry and never reviewed.

The durable fix is a default-deny posture: block everything inbound, then explicitly allow only what the service genuinely needs — typically 80 and 443 for a web host, and little else. Administrative access (SSH, RDP, database consoles) belongs behind a VPN or a bastion host rather than on the open internet, even with strong credentials. And a note on ethics that doubles as law: only scan hosts you own or are explicitly authorized to test. Unauthorized scanning violates computer misuse legislation in most jurisdictions and most providers' acceptable-use policies, regardless of intent.