Every port SubAnalyzer scans and what it means

An open port means a service at that address is accepting network connections. When SubAnalyzer reports one, the service was reachable from the internet during the scan. It may still require authentication before anyone can use it.

Public HTTPS on a website is expected. A database, desktop session or container management API deserves closer attention. The question is whether the service needs public access and how that access is protected.

SubAnalyzer checks 58 TCP ports on every scan, on the public IPv4 addresses each subdomain resolves to, up to 8 addresses a host. IPv6 addresses are recorded but not scanned for services. UDP services, such as SNMP on 161/udp, are not scanned at all.

A port missing from your results does not prove that nothing listens there. The service may use another port, IPv6 or UDP, or a firewall may have blocked the scan. An open port does not prove a vulnerability either.

The five categories below match the colored port chips in your results. Each label is a common use of the port number. It does not identify the software or version running there, and a port with no single common use shows its number alone. As the IANA port registry explains, traffic on a registered port can belong to a different service.

Web ports

These 22 ports cover public websites, alternative web listeners, development servers and management interfaces. A public application can legitimately use any of them. An administration page needs tighter access controls, even when its connection is encrypted.

Websites and alternative web ports

Port 8443 is not dangerous by itself. An authenticated production application there may be intentional. A forgotten administration page on the same port is a different finding. The application and its access controls determine the risk.

Development servers and management interfaces

Defaults vary. Jupyter enables token authentication by default, while ActiveMQ documents default console credentials that should be changed. Check the deployed configuration before concluding that an interface is unprotected.

Database ports

These six ports cover databases, search indexes and caches. They usually belong on private networks or behind rules that allow only the applications and administrators that need them. A public listener increases exposure even when a password is required.

Redis has no password configured in a basic default setup, but its protected mode can reject remote commands. Elasticsearch automatically enables security on eligible new installations. Neither an open 6379 nor an open 9200 establishes that data is accessible without authentication. Verify the actual settings using the Redis security guide and Elasticsearch security documentation.

Memcached's documentation explicitly warns against public exposure. Its known traffic amplification problem involves UDP, so a TCP finding on 11211 does not establish that amplification is possible. See the Memcached configuration guide and UDP advisory.

Email ports

These seven ports support sending and retrieving email. Public reachability is normal when you operate a mail server. Unexpected mail services on a development or application host are worth investigating.

Require encryption for mailbox access and client submission, and authenticate users before accepting their outgoing mail. A service scan does not verify those policies. The email TLS standard explains the distinction between encryption at connection time and an upgrade through STARTTLS.

Remote access ports

These five ports can provide a shell, a desktop or access to a graphical session. Review them promptly when they appear on an unexpected host.

CISA recommends limiting exposed remote desktop services, using multifactor authentication and closing unused access.

Infrastructure ports

These 18 ports cover file sharing, network services, container management, dashboards and messaging. Some are expected on public infrastructure. Others expose services normally intended for trusted clients.

File sharing and network services

Microsoft documents 1025 at the start of the older Windows dynamic port range. It does not reliably identify the listener. Microsoft also recommends blocking inbound SMB from the internet and replacing PPTP.

Container management

Encryption alone does not establish that clients are authorized. Check client authentication and permissions using Docker's daemon protection guide and Kubernetes' guidance on API access controls and kubelet authentication and authorization.

Dashboards and messaging

Prometheus Pushgateway and Transmission both use 9091 by default. The number alone cannot distinguish a metrics endpoint from a torrent client's management interface.

How to read your scan results

Each subdomain lists its open ports as colored chips, such as 443 HTTPS and 22 SSH. The Services tile counts distinct open port numbers across the scan. If 20 subdomains all expose 80 and 443, the tile counts two distinct ports.

Use the Services filter to list the subdomains that have any of the ports you select open.

SubAnalyzer treats 14 of the web ports as web servers: 80, 81, 8000, 8080, 8081, 8082, 8880, 8888 and 9080 for HTTP, and 443, 4443, 8443, 9443 and 10443 for HTTPS. When one of them is open, SubAnalyzer takes a screenshot of the page. The first page of screenshots is free; paid plans show every screenshot and its page type.

On the HTTPS ports it also reads the certificate. Names on a certificate can reveal more subdomains, which are then scanned too.

Ports on shared addresses

An open port belongs to an address, not to a name. A subdomain shows the open ports of every address it resolves to, so subdomains that share an address show the same ports. On shared hosting or a CDN, the service behind such a port can belong to the provider or to another customer.

Some edge networks answer on the same ports for every site they serve. When a subdomain on Cloudflare or Imperva shows that provider's full set of ports, those chips turn yellow and say the provider almost always has the port open. Ports 80 and 443 keep their usual color.

A plain TCP connection shows only that something at the address answers. On the HTTP and HTTPS ports, SubAnalyzer also connects under the subdomain's own name, and the screenshot shows the page that name gets. For any other port on a shared address, check who runs the address before you act on it.

How SubAnalyzer confirms an open port

The service scan starts with a fast pass that sends the opening packet of a TCP connection. A reply alone is not enough, because firewalls and protective services can answer for ports with no application behind them.

Before showing a port, SubAnalyzer opens a real connection to it. The port counts as open when the service sends something back, such as a TLS handshake, an HTTP response or a banner, or when the connection stays open without being reset. A reset or an immediate close counts as closed.

Every address is also checked on port 2, where nothing should listen. If the fast pass gets a reply there, its other replies from that address are dropped. If a connection to port 2 also stays open, only completed TLS handshakes and HTTP responses count for that address. Ports 80 and 443 are always tried under every subdomain's name, and ports seen in recent scans are checked again.

The fast pass sends no more than about 25 probes a second to any one address. SubAnalyzer never logs in, identifies software versions or tests for vulnerabilities.

For the full process, read our guide to subdomain enumeration.

What to do about an unexpected port

1. Identify the service and its owner. Check which application is listening and why it needs network access. Use the port label as a starting point.
2. Restrict unnecessary public access. Update firewall or cloud network rules, bind the service to a private interface, or disable it if it is unused. Check dependencies before making changes.
3. Review access controls. Require appropriate authentication, limit permissions, enable encryption and install security updates. If sensitive data may have been exposed, investigate access logs and affected credentials.
4. Re-scan and monitor. Verify the change from outside your network, then watch for the port returning.

This follows CISA's internet exposure reduction guidance: identify exposed services, decide which need public access and protect those that remain.

SubAnalyzer can re-scan a monitored domain daily, weekly or monthly and send one email when something changes. Newly opened or closed ports are among the changes it reports. Monitoring is part of the paid plans.

Scan your domain with the subdomain finder to see which of these services are reachable across your subdomains.

Sources

• IANA service names and port numbers
• Flask development server guidance
• ActiveMQ web console
• Jupyter Server security
• MinIO AIStor console and API ports
• Prometheus security model
• Prometheus basic authentication
• Prometheus default port allocations
• Webmin security advisories
• Oracle WebLogic Server production lockdown guide
• Cisco Expressway default port ranges
• PostgreSQL client authentication rules
• Redis security
• Elasticsearch networking settings
• Elasticsearch automatic security setup
• Memcached configuration
• Memcached UDP amplification advisory
• RFC 8314, TLS for email submission and access
• CISA StopRansomware Guide
• RFC 4248, telnet URI scheme (security considerations)
• RFC 6143, VNC protocol and security
• X.Org security documentation
• RFC 2577, FTP security considerations
• RFC 4217, FTP over TLS
• RFC 1227, SMUX
• Microsoft Windows service and port requirements
• Microsoft SMB security guidance
• Microsoft VPN protocol guidance
• Docker daemon protection
• Kubernetes API access controls
• Kubelet authentication and authorization
• Prometheus Pushgateway documentation
• Transmission configuration
• CISA internet exposure reduction guidance