What Can a Free ThreatPort Domain Scan Reveal About My External Attack Surface?

A free ThreatPort domain scan reveals what your domain exposes on the public internet: subdomains, exposed services, open ports, SSL certificate issues, DNS and email security gaps such as missing SPF or DMARC records, and technologies that may be linked to known vulnerabilities. It is a self-serve, agentless starting point — no installation or sales call required — intended for IT managers, CISOs, CTOs, and lean security teams who want practical security evidence before attackers, auditors, or customers find the same exposure. The free scan is a discovery step; continuous monitoring and deeper analysis sit in the paid plan.

Subdomains and exposed services

The scan starts from a single domain and maps what is publicly reachable, including subdomains you may not have inventoried. This matters because forgotten or shadow subdomains are a common way an organization's real footprint grows beyond what the internal team tracks.

What the scan surfaces here:

• Subdomains associated with your domain, including ones outside your current asset list
• Exposed services running on those hosts
• Weak or missing HTTP security headers, which affect how browsers enforce protections on your sites

The practical value is reconciliation: compare the discovered list against your own records. Anything you cannot account for is worth investigating first.

Open ports and SSL certificate problems

Open port visibility shows which services are reachable from the public internet. Certificate monitoring flags issues with the TLS certificates protecting those services.

Look for:

• Open ports that expose services you did not intend to publish
• Certificate issues such as expiring, misconfigured, or otherwise problematic SSL/TLS certificates

Expired or misconfigured certificates are both a trust problem (browser warnings for customers) and an operational one (broken integrations). Because certificates expire on a schedule, a one-time scan is a snapshot — this is exactly the kind of finding that continuous monitoring in the paid plan is designed to catch before it lapses.

DNS and email security risks

The scan checks DNS and email security configuration, including missing SPF or DMARC records. These records control whether others can send email that appears to come from your domain and how receiving mail servers should treat it.

A missing or weak SPF/DMARC setup means your domain is easier to spoof in phishing and business email compromise attempts aimed at your customers, partners, or staff. This is one of the more actionable categories from a free scan because the fix is usually a DNS record change rather than an infrastructure project — and it is also the kind of gap auditors and security questionnaires tend to ask about.

Technologies linked to known vulnerabilities

The scan identifies technologies in use and maps them against known vulnerabilities (CVEs). This connects what you are running to what is publicly documented as exploitable.

Treat this as a prioritization signal, not a verdict:

• A flagged technology means it may be linked to known vulnerabilities — you still need to confirm the version and configuration in use.
• CVE mapping helps you decide which exposures to remediate first, based on what is publicly known rather than guesswork.

What the free scan is and is not

The paid plan is priced at 50 USD per month per domain. If you only need a point-in-time view of what is exposed, the free scan answers that question. If you need ongoing monitoring, deeper analysis, or reports you can hand to leadership or auditors, that is what the paid tier adds.

How to get useful results from the free scan

1. Run the scan against your primary domain. The platform is agentless and self-serve, so no installation or onboarding call is needed.
2. Export or record the findings across the categories above — subdomains, services, ports, certificates, DNS/email records, and flagged technologies.
3. Reconcile against your known inventory. Flag any subdomain or service you cannot explain.
4. Fix the cheap, high-impact items first. Missing SPF/DMARC records and expiring certificates are typically quick wins with clear ownership.
5. Confirm before escalating CVE findings. Verify the actual version and exposure of any flagged technology before treating it as confirmed.
6. Decide whether a snapshot is enough. If your footprint changes often or you need audit-ready reporting, the continuous monitoring and reporting in the paid plan address the gaps a one-time scan leaves open.

The scan tells you what is visible from the outside. What you do with that list — and whether you need to keep watching it — is the decision the results should drive.