Open Ports and Exposed Services: Network Perimeter Findings

Internet-exposed ports and services that do not need to be public are direct targets for automated attackers — every unnecessary open port is a potential entry point. Botnets continuously scan the entire IPv4 address space, cataloguing open ports and service banners within hours of a new service coming online. If your RDP port, database, or Kubernetes API is reachable from the public internet, it is already known to attackers. Leverage Cyber surfaces these exposures by querying passive internet-wide datasets so your team knows what attackers know — without any active probing of your infrastructure.

​

What Gets Flagged

Not every open port is a finding. Leverage Cyber distinguishes between expected public-facing services — web servers on port 80 and 443, for example — and services that represent genuine risk when exposed to the internet. The following service categories generate findings when discovered externally: Remote Access Protocols Remote Desktop Protocol (RDP) on port 3389, SSH on port 22, and VNC on port 5900 should never be directly internet-accessible in a mature security posture. These protocols are the top entry vectors for ransomware operators and nation-state actors. Exposure to the public internet means every threat actor on the planet can attempt authentication against them continuously and silently. Management and Orchestration Interfaces Kubernetes API servers (ports 6443 and 8443), Docker daemon sockets (port 2375 and 2376), and container registry endpoints are frequent targets because compromise grants control over entire workloads, not just a single host. Database management ports — MySQL on 3306, PostgreSQL on 5432, MongoDB on 27017, Redis on 6379, and Elasticsearch on 9200 — should never be bound to public interfaces. Legacy and Insecure Protocols Telnet (port 23) transmits all data including credentials in plaintext. FTP (ports 20 and 21) is similarly unencrypted and subject to credential interception. SMTP open relays (port 25) allow your mail infrastructure to be abused for spam and phishing at scale. These protocols have secure, modern replacements and their presence on a public interface represents both a technical and compliance risk. Cloud Metadata Endpoints The instance metadata service (IMDS) is intended to be accessible only from within a cloud instance. When misconfigured networking or a server-side request forgery (SSRF) vulnerability makes metadata endpoints reachable from external networks, attackers can retrieve IAM credentials and environment configuration that enable full cloud account compromise.

​

How Findings Are Categorized

Risk levels reflect the typical worst-case outcome when the service is discovered and attacked. Your specific severity in the dashboard may be adjusted based on whether authentication is confirmed, whether the service is on a known KEV list, and the criticality of the host.

​

Finding Fields

Each open port or exposed service finding includes the following structured fields in the Leverage Cyber dashboard.

​

Passive vs. Active Detection

All port and service findings in Leverage Cyber are sourced exclusively from passive data. Leverage Cyber never initiates connections to your IP ranges, never sends packets to your hosts, and never performs any action that would appear in your network logs as an inbound connection from us. Findings come from three types of passive sources:

• Internet-wide scan datasets — Organizations such as Censys, Shodan, and similar research platforms continuously scan the public internet and publish the results. Leverage Cyber queries these datasets to identify services associated with your IP ranges and domains. Their scanning, not ours, produces the underlying data.
• Certificate transparency logs — TLS certificate issuance records reveal hostnames and IP associations that help map your infrastructure, including services running on non-standard ports that use HTTPS.
• OSINT aggregators and threat intelligence feeds — Dark web forums, paste sites, and threat actor repositories frequently share service discovery results. Leverage Cyber monitors these sources to surface your exposed services from the attacker’s perspective.

This passive-only approach means findings represent genuine, externally observable exposure — not theoretical vulnerabilities discovered through intrusive testing.