Open ports on my IP: check your own exposure, with consent
How does this check work, and what does the result tell you?
AdminKit scans only the public IP address you are connecting from, only after you click to start it, against a fixed list of TCP ports device makers commonly leave open by mistake — never an address you type in for someone else.
Part of the Security basics cluster — more tools, guides and terms on security basics.
AI explanation Run a check below, then sign in to ask AI to explain the result in plain language.
This scans only the public IP address you are connecting from right now — never an address you type in, and never someone else's host.
Next step
Check your current IP now, or see SSL/TLS check for a related exposure.
Keep this result
Copy a link to this check so you can share it or run it again later. Want a heads-up when this result changes? Talk to our team and we'll set it up for you.
How it works and limits
Routers, cameras, NAS boxes and other home or small-office devices sometimes expose a management or data port directly to the internet, usually through UPnP automatically opening a port, or a misconfigured firewall rule. An exposed port on a protocol with weak or no authentication is one of the most common ways these devices get compromised at scale — several of the protocols checked here appear on CISA’s Known Exploited Vulnerabilities Catalog when left reachable and unpatched.
What it checks
- Only the public IP address sending the request, and only after you click to start it — never an address you type in for someone else; AdminKit’s Check API itself refuses any other target for this check.
- Nine TCP ports device makers commonly leave open by mistake, with their
IANA-registered
service names:
- 23 — Telnet
- 554 — RTSP
- 1883 / 8883 — MQTT
- 502 — Modbus
- 7547 — TR-069/CWMP
- 80 / 443 / 8080 — admin web UIs
- Whether each port responds at all — not its contents, and never an attempt to log in or exploit anything found.
Limits
- UDP-based ports — BACnet/IP (47808) and CoAP (5683) — are not scanned yet; this check currently only probes TCP.
- Your public IP can be shared (CGNAT, a mobile carrier, or a NAT router in front of several devices) — a result here describes whatever device currently answers on that shared address, which may not be the one you expect.
Check manually today
From a machine outside your network (scanning your own router from inside it will show the wrong thing), test a single port against your own public IP (see the My IP tool for your current address):
nc -vz -w 3 203.0.113.5 23A connection that succeeds means the port is open to the internet; “connection refused” or a timeout means it is closed or filtered. Repeat for each port in the list above, only against an IP address you control.
Read more about port exposure
Ports this tool scans:
- Telnet (23) and RTSP (554): why camera and router admin ports end up exposed, with per-port detail on is port 23 (Telnet) exposed? and is port 554 (RTSP) exposed?.
- TR-069/CWMP (7547): what it’s for and when it’s a risk, detail page is port 7547 (TR-069) exposed?, reference TR-069.
- Common admin-panel HTTP (8080): detail page is port 8080 (admin panel) exposed?.
Related ports this tool does not scan yet, with their own guides:
- BACnet/IP (47808, UDP): building-automation exposure, explained, detail page is port 47808 (BACnet/IP) exposed?, reference BACnet.
- CoAP (5683, UDP): detail page is port 5683 (CoAP) exposed?.
- RDP (3389) and VNC (5900): why direct remote-desktop exposure is high-risk, detail pages is port 3389 (RDP) exposed? and is port 5900 (VNC) exposed?.
- Redis (6379): a quick exposure check for open, unauthenticated databases, detail page is port 6379 (Redis) exposed?.
A factory or building-automation asset found exposed here is exactly what AdminKit’s OT Remote Access moves behind outbound-only, zero-trust access instead of leaving reachable directly from the internet, set up by Netbase as a custom engagement.
See how this check compares to canyouseeme.org, yougetsignal.com, portchecker.co and ping.eu if you need to check an arbitrary host or port those general tools cover and this one, by design, does not.
Frequently asked questions
Will this scan other people's IPs?
No — by design it only ever scans the public IP address the request comes from (determined server-side, the same way the My IP tool reads it), and only after you click to start it. There is no field to type in someone else's address; AdminKit's Check API itself refuses a `ports` scan whose target isn't the caller's own IP.
Which ports does it check?
Nine TCP ports device makers commonly leave open by mistake: 23 (Telnet), 554 (RTSP), 1883/8883 (MQTT), 502 (Modbus), 7547 (TR-069), and 80/443/8080 (admin web UIs).
What does an 'open' result mean?
Only that the port accepted a TCP connection within the timeout — not that it is misconfigured or that credentials were tried. The result names the specific port and protocol so you know what to lock down, never a vague 'issue found' label.
Will it try to log in or exploit anything it finds open?
No. The check stops at a bare connection attempt; it never sends protocol commands, credentials or exploit payloads, matching AdminKit's own no-exploitation rule for active checks.
Does it check UDP ports like BACnet or CoAP?
No — BACnet/IP (47808) and CoAP (5683) are UDP-based and this check currently only probes TCP connections, so those two ports are not covered by this tool today.