Open port scan check
Weekly scan of the top 20 attack-surface ports (SSH, RDP, MySQL, Redis, MongoDB…) so a forgotten firewall rule cannot silently expose your DB.
Quick answer
Lemwatch runs a lightweight TCP SYN probe against 20 high-risk ports weekly. New unexpected opens raise severity: high.
What it checks
- SSH (22), RDP (3389), Telnet (23)
- MySQL (3306), Postgres (5432), Redis (6379), MongoDB (27017), Memcached (11211), Elasticsearch (9200)
- FTP (21), SMB (445)
- Common admin panels (8080, 8443, 10000)
Where to find it in Lemwatch
Site details → Security → Ports.
How to respond
- Confirm whether the port is intentionally open.
- If not, close it at the cloud firewall or security group.
- If required (SSH), restrict source IPs and enable key-only auth.
- Acknowledge to baseline the new state.
FAQ
Is this an intrusive scan?
No — single SYN packet per port, no exploit attempts, throttled to be invisible to standard IDSes.
Do you scan all 65k ports?
No — only curated high-risk ports. A full scan would trigger AUP violations on most clouds.
Related