Home / Security Tools / Exposure Check
Security Tools
Internet-facing services on a host or range.
The Exposure Check identifies the internet-facing services on a host or small CIDR range by probing a set of common service ports, giving you an external view of what is reachable from the public internet.
Enter a host or a small CIDR range (203.0.113.0/29) and run the tool. The probe tests a set of common service ports from our edge location.
Input: Host or CIDR — e.g. 203.0.113.0/29.
Each line shows an address, port and whether it is OPEN or CLOSED, with the typical service for that port. OPEN ports are services reachable from the internet — every open port is potential attack surface. Close or firewall any service that does not need to be publicly exposed.
→ Audit which services on a host are reachable from the internet.
→ Verify a firewall change closed the intended ports.
→ Check a small CIDR range for unexpected exposed services.
→ Confirm administrative ports are not publicly reachable.
Administrative ports (22 SSH, 3389 RDP, 5900 VNC) should rarely be open to the whole internet — restrict them to a VPN or jump host. Web (80/443) and mail (25/465/587) are expected to be open if those services are public.
Close or firewall any port that does not need public access, put administrative services behind a VPN, and use security groups to restrict ingress to known IPs. Every port you close is one fewer path an attacker can probe.
A service was started without a firewall rule, a default config binds to 0.0.0.0 instead of localhost, or a cloud security group allows all ingress. Audit running services and tighten both host firewalls and cloud security groups.