Scanning a Bare IP? We Now Check for Exposed Databases and Open Ports Too
Decloak has always supported scanning a bare IP address directly, no scheme, no domain required. What that scan checks just got a lot more useful. When the resolved target is a literal IP, Decloak now runs passive reconnaissance against it, checking commonly-abused ports for exposed services and running a reverse DNS lookup.
What gets checked
Around 18 ports across a few categories that consistently show up in real-world exposure incidents:
- Databases: MySQL, PostgreSQL, MongoDB, Redis, Elasticsearch, Memcached, MSSQL, Oracle
- Remote access: RDP, VNC, SSH, Telnet
- File transfer and mail: FTP, SMTP, POP3, IMAP
- File sharing: SMB
- Containers: an unauthenticated Docker API
Each one carries a severity that reflects real-world exploitation risk rather than treating every open port the same. An exposed Redis instance, an open MongoDB, or an unauthenticated Docker API is a critical finding, these are frequently found completely unauthenticated in the wild and handed over full read/write access the moment someone connects. RDP, SMB, and the other databases are high severity. SSH and SMTP show as informational, since those being open is often entirely normal and expected.
Deliberately passive
This is connect-only reconnaissance, not a probe. It never sends payload data or attempts to exploit anything, it reads whatever banner a service volunteers unprompted in a short connection window, the same information a service would hand over to any client that connected normally. That makes it noticeably gentler than the active-testing checks used elsewhere in the product, appropriate for something that runs automatically without a separate consent step.
Alongside the port check, a reverse DNS (PTR) lookup runs too, useful context for understanding what's actually sitting behind the IP you're scanning.
If nothing's open, you still get an explicit "checked, nothing found" finding rather than silence, so you know the check ran rather than wondering whether it was skipped.
Why we built it
This closes out a piece of IP and bare-domain scanning support that was deliberately deferred when that capability first shipped. It was worth coming back to: an exposed database or an unauthenticated admin service is one of the most concrete, unambiguous "you have a real problem" findings a scanner can produce, considerably higher signal than a lot of the configuration-hygiene findings that make up the bulk of a typical report.
Availability
Runs automatically whenever a scan target resolves to a literal IP address, on Starter and above. We deliberately didn't extend arbitrary port scanning to domain targets, scanning a domain's underlying infrastructure this way carries a different risk profile than scanning an IP the user explicitly provided as the target.
Open port and service discovery for IP scans is included on Decloak Starter and above. See plans →