See which ports and services your domain exposes to the public internet. Spot critical risks like open SSH, MySQL, Redis, or RDP before attackers do.
Most production breaches don't start with a zero-day. They start with a port that shouldn't be open. This checker resolves your domain to an IP, queries Shodan's InternetDB (the same passive scan data security researchers and attackers use), and tells you exactly what the rest of the internet can see.
## The exposed-database problem
Since 2017, security researchers have documented thousands of internet-exposed Redis, MongoDB, Elasticsearch, and PostgreSQL instances containing production data. Most weren't hacked — they were simply running on 0.0.0.0 with no authentication, and an automated scanner found them within hours of going live. If this tool shows port 6379 (Redis), 27017 (MongoDB), 9200 (Elasticsearch), or 5432 (PostgreSQL) open, you have minutes-to-hours before an automated scanner finds it.
## SSH on port 22 — why it matters
Exposed SSH isn't a vulnerability by itself, but it's a constant target. A single internet-exposed SSH port will receive 1,000+ brute-force login attempts per day from the moment it's reachable. Best practice for years has been: SSH behind a VPN, or use a bastion host, or use AWS SSM / GCP IAP / Tailscale SSH. There's no good reason a production SSH port should be on the public internet.
## How Shodan finds you
Shodan continuously scans the entire IPv4 internet, recording open ports and service banners. They publish a free passive lookup (InternetDB) that returns the open-port list and known CVEs for any IP. That's what we query — no active scanning, no impact on your servers, and the data is the same data attackers have access to.
## CVE matching via CPE
When Shodan fingerprints a service it produces a CPE (Common Platform Enumeration) string like `cpe:2.3:a:nginx:nginx:1.18.0`. Known CVEs are mapped to CPEs in the NVD database. If our check returns vulnerabilities, those are real CVEs affecting your detected service version — patch them.
## Risk level interpretation
- **Critical**: Known CVEs present, or admin database/management ports exposed. Fix today. - **High**: Critical service ports (SSH, RDP, SMB, FTP) reachable. Move behind VPN. - **Medium**: Many non-standard ports open. Audit each one. - **Low**: Only standard web ports (80, 443). Healthy baseline.
Every unnecessary open port is an attack surface. Open Redis or MongoDB instances have caused some of the largest data breaches of the last decade. Even an exposed SSH port invites brute-force attacks that show up in your logs and inflate your bandwidth bill.
We resolve your domain to an A record using Google DNS-over-HTTPS, then query Shodan's public InternetDB endpoint for that IP. The response lists open TCP ports, server tags, hostnames sharing the IP, CPE strings, and any CVEs linked to those CPEs. We classify each port against a known table of critical services (databases, admin protocols, file shares), standard web services (80, 443, 8080, 8443), and unknowns. The overall risk level is derived: critical if any known CVE is present, high if any critical port is exposed, medium if >5 non-standard ports are open, low otherwise. We never actively port-scan your servers — all data comes from Shodan's passive scan, which is the same data attackers see anyway.
No. We query Shodan's passive scan results. Your server sees no traffic from this check — Shodan already scanned the internet, we just look up what they found.
You'll see Cloudflare's edge IP, which is the only IP exposed to the internet. Your origin IP behind Cloudflare is not checked (which is the correct behaviour — that's the value of using a proxy).
Restrict it at the firewall to only the IPs that need it (e.g. office IP, VPN range). Open-to-everyone is the problem; open-to-trusted-sources is fine.
Shodan re-scans most of the IPv4 internet every 1–2 weeks. If you just closed a port, it may still show as open for up to two weeks until Shodan re-scans.
For public visitors, no — results are returned to your browser and discarded. For authenticated LemWatch users, results are stored against your site for trend analysis.