Every Port SubAnalyzer Scans and Why
From web servers and databases to container orchestration and remote access, a breakdown of the nearly 60 TCP ports SubAnalyzer checks on every scan
Discovering a subdomain tells you it exists. Port scanning tells you what it does. An open port means a running service, and every running service is a potential entry point, information leak, or misconfiguration waiting to be found.
SubAnalyzer scans a curated set of TCP ports chosen to cover the services most commonly found on internet-facing infrastructure. The list balances breadth of coverage against scan speed: enough ports to catch web servers, databases, remote access tools, and container orchestration endpoints, but not so many that scans take longer than they need to.
Web Servers
Ports 80, 81, 443, 4443, 8000, 8080, 8081, 8082, 8443, 8880, 8888, 9443, 10443
Standard HTTP (80) and HTTPS (443) are the baseline, but a huge amount of interesting infrastructure lives on alternative ports. Development servers often bind to 8080 or 8000. Admin panels and internal proxies frequently use 8443, 8888, or 4443. These alternative web ports are some of the most common places to find exposed dashboards and forgotten staging environments.
Ports 25, 110, 143, 465, 587, 993, 995
SMTP (25, 465, 587), POP3 (110, 995), and IMAP (143, 993) reveal mail infrastructure. Finding these ports open tells you which subdomains handle e-mail, whether they support encrypted connections, and whether any unexpected mail servers are running on your domain.
Remote Access
Ports 21, 22, 23, 3389, 5900
FTP (21), SSH (22), Telnet (23), RDP (3389), and VNC (5900) are direct access protocols. SSH is expected on many servers, but the others are high-risk when internet-facing. Telnet transmits credentials in plaintext. RDP and VNC exposed to the internet are frequent targets for brute-force attacks. FTP servers often contain sensitive files with weak or default credentials.
Databases
Ports 3306, 5432, 27017
MySQL (3306), PostgreSQL (5432), and MongoDB (27017) should almost never be reachable from the public internet. When they are, it usually means a firewall rule is missing or a cloud security group is misconfigured. An exposed database port is one of the most critical findings a scan can produce.
DNS and Network Services
Ports 53, 111, 113, 139, 445, 548, 1720, 1723
DNS (53) identifies nameservers. RPCbind (111) and Ident (113) are legacy Unix services that leak host information. NetBIOS (139) and SMB (445) are Windows file sharing protocols that have been the vector for some of the most damaging attacks in history. AFP (548) is Apple file sharing. H.323 (1720) and PPTP (1723) indicate VoIP and VPN infrastructure. None of these should be exposed without a clear reason.
Infrastructure and Orchestration
Ports 1025, 2376, 6443, 10250
The Docker API (2376), Kubernetes API (6443), and Kubelet (10250) are container management endpoints. An exposed Docker API gives an attacker full control over the host. An unauthenticated Kubelet endpoint lets anyone execute commands inside running containers. Port 1025 is used by NFS and some IIS configurations. These are among the most critical ports to monitor because they control infrastructure itself.
Monitoring, Caching, and Messaging
Ports 5601, 5672, 6001, 6379, 9000, 9080, 9090, 9091, 9092, 9200, 10000, 11211
Kibana (5601) exposes log data and dashboards. RabbitMQ (5672) handles message queues. Redis (6379) and Memcached (11211) are in-memory data stores that often run without authentication by default. Prometheus (9090, 9091) exposes metrics. Kafka (9092) handles event streams. Elasticsearch (9200) exposes indexed data. Webmin (10000) is a server administration panel. Port 6001 is used by X11 display servers, and 9000 by various admin tools including SonarQube and MinIO. When any of these are reachable from the internet, they frequently expose sensitive data or provide unauthenticated access.
Application Servers
Ports 199, 3000, 5000, 7001, 7002, 8161
SMUX (199) is used for SNMP multiplexing. Ports 3000 and 5000 are the default ports for many development frameworks including Node.js, Flask, and Grafana. WebLogic (7001, 7002) is an enterprise Java application server with a history of critical vulnerabilities. ActiveMQ (8161) exposes a web-based management console. Finding these ports open often indicates development or internal tooling that was not intended to be public.
How Port Results Are Used
Port scan results feed directly into the rest of the SubAnalyzer pipeline. Subdomains with port 443 open get their TLS certificates inspected for additional subdomain names. Open ports determine which services are listed in the results table, making it easy to filter by web servers, databases, or remote access. Cloud provider and organization data is enriched per IP, giving you hosting context alongside the port data.
For a full walkthrough of how port scanning fits into the discovery pipeline, see How Subdomain Discovery Works.
Want to see what ports are open across your subdomains? Start a free scan and get the full picture in minutes.