S4E just found a high top 10 tcp port service scan
high·Information Scans·Updated Feb 14, 2026

Top 10 TCP Port Service Scan

Active Top-10 TCP probe to detect exposed critical services using protocol-aware validation and banner negotiation.

Est. Time~5 minutes
Scan TypeSingle Scan
Targetsdomain, ipv4, subdomain
CostFree
1647.9k
Times Used
by S4E users
3.8k
Assets Scanned
domains & IPs
4.6k
Vulnerabilities Found
confirmed findings
Detail

This scan performs an active CTEM Top-10 TCP service probe against a predefined set of commonly exposed ports (80, 443, 22, 3389, 21, 25, 53, 110, 143, 445). Rather than conducting a full port sweep, it targets high-risk and frequently abused services to provide fast and noise-controlled exposure visibility.

For each port, the engine establishes a direct TCP connection and performs protocol-aware validation where applicable: HTTP/HTTPS are verified via HEAD requests, SSH and RDP are validated through protocol handshake fingerprints, and FTP/SMTP/POP3/IMAP are identified using banner inspection. DNS and SMB ports are confirmed through TCP connectivity checks.

Closed, filtered, timed-out, or unreachable ports are excluded from the results to eliminate false positives. Only successfully negotiated or reachable services are reported in the standardized format: port tcp service (e.g., 22 tcp ssh).

This focused detection approach provides rapid identification of externally exposed critical services, enabling security teams to prioritize hardening, access control enforcement, and attack surface reduction efforts in alignment with Continuous Threat Exposure Management (CTEM) principles.

Solution Advice

Review all detected exposed services and verify whether they are intentionally published. This scan targets high-risk ports (80, 443, 22, 3389, 21, 25, 53, 110, 143, 445) and confirms services using active protocol negotiation rather than simple port status checks.

For externally accessible services, enforce the principle of least privilege: restrict access via firewall rules, VPN, IP allowlists, or zero-trust policies. Disable unused services and close unnecessary ports immediately.

Ensure all confirmed services (e.g., SSH, RDP, FTP, SMTP) are hardened: use strong authentication, disable legacy protocols, enforce TLS where applicable, and apply the latest security patches.

Continuously monitor exposed services within your CTEM program to reduce attack surface and prevent opportunistic exploitation.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.