Check 47 of 54 · Attack surface
Risky services open to the internet on your subdomains' addresses, read from the same public index.
Engine 1.57.0, read 25 October 2026
What have you left open to the internet?
The hosts your mail and SPF records name, then the names a stranger tries first, such as vpn. and remote., then your hostnames from public certificate logs, the most notable first, until 30 still resolve. Up to 20 of their addresses are looked up in a public internet index, for high-risk services and the vulnerabilities it lists against them.
Remote access and admin services often sit on subdomains such as vpn. or remote., which the website's own checks never read.
A failure is a finding in your result. The check is scored, so it can lower your score, and the Full Report gives every finding its severity and a fix. If the check cannot finish, it is recorded as unknown: it carries no penalty, and it is never a pass.
An address that belongs to a content network or firewall service, or that your website already uses, is left out. A load-balanced address the index does not tie to your domain is set aside. Vulnerabilities are the index's inference from version numbers, and on shared hosting the listing is the provider's to fix.
It reads up to 30 of your other hosts, which is more than a check of a domain that is not yet a customer should ask, so it runs on a customer's own verified domains, not on the free check.
Check 47 is one of 5 in Attack surface. See it in its row on the scanner page, beside the rest of Attack surface.
This check runs on a customer's own verified domains. The free check runs over 40 checks in about 30 seconds, with no account.