Open ports on my IP: check your own exposure, with consent
Will scan only the IP sending the request, only after explicit consent, against a fixed list of commonly exposed device ports such as Telnet, RTSP, MQTT, Modbus and BACnet, never an address you type in for someone else. Coming with the AdminKit Check API.
A scan of only the IP sending the request, only after you opt in, against a fixed list of commonly exposed device ports.
- Telnet 23, RTSP 554, MQTT 1883/8883, Modbus 502, BACnet 47808, CoAP 5683, TR-069 7547, admin UIs 80/443/8080
- Whether each port responds at all — never an attempted login or exploit
- Ships with the AdminKit Check API (plan milestone M5)
Next step
Check your current IP now, or see SSL/TLS check for a related exposure.
How it works and limits
Routers, cameras, NAS boxes and other home or small-office devices sometimes expose a management or data port directly to the internet, usually through UPnP automatically opening a port, or a misconfigured firewall rule. An exposed port on a protocol with weak or no authentication is one of the most common ways these devices get compromised at scale.
What it will check
- Only the IP address sending the request, and only after you click to opt in — never an address you type in for someone else.
- A fixed list of ports device makers commonly leave open by mistake: 23 (Telnet), 554 (RTSP), 1883/8883 (MQTT), 502 (Modbus), 47808 (BACnet), 5683 (CoAP), 7547 (TR-069), and 80/443/8080 (admin web UIs).
- Whether each port responds at all — not its contents, and never an attempt to log in or exploit anything found.
Why this is not live yet
A safe, abuse-resistant port scanner needs rate limiting, consent tracking and infrastructure separate from the static site — this ships with the AdminKit Check API, built alongside it rather than bolted onto a Pages Function.
Check manually today
From a machine outside your network (scanning your own router from inside it will show the wrong thing), test a single port against your own public IP (see the My IP tool for your current address):
nc -vz -w 3 203.0.113.5 23A connection that succeeds means the port is open to the internet; “connection refused” or a timeout means it is closed or filtered. Repeat for each port in the list above, only against an IP address you control.
Frequently asked questions
Will this scan other people's IPs?
No — by design it only ever scans the IP address the request comes from, and only after you opt in.
Which ports will it check?
A fixed list of ports device makers commonly leave open by mistake: 23 (Telnet), 554 (RTSP), 1883/8883 (MQTT), 502 (Modbus), 47808 (BACnet), 5683 (CoAP), 7547 (TR-069), 80/443/8080 (admin UIs).