Internet-wide scanners probe every public IPv4 address continuously, so anything listening publicly gets found. Public and private addresses, the ports that matter, why databases and admin tools should not face the internet, what a public IPv4 address costs on AWS, and the replacement for open SSH.
An IP address identifies a machine on a network; a port identifies a service on it. A public address is reachable from the whole internet, and services such as Shodan and Censys continuously scan every public IPv4 address for open ports. Assume anything listening publicly will be found.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Supabase, Neon and similar platforms expose Postgres to the internet on purpose, behind authentication and TLS. That is a reasonable trade for convenience. An RDS instance marked publicly accessible with a security group open to 0.0.0.0/0, or a Redis container with no password on a VM, is the accident. The difference is whether authentication and encryption were designed in, or the port was simply left open.
Security groups are allow-lists. Open 443 on the load balancer to the world; open the database port only to the application's security group.
Put databases and caches in private subnets with no public address.
Replace SSH with Session Manager: no open port, access through IAM, sessions logged.
Each public IPv4 address costs $0.005 an hour, about $3.65 a month, attached or idle. Release the ones you do not need and use IPv6 where clients support it.
Turn on S3 Block Public Access at the account level. New buckets block public access already, but account-level settings apply even if someone loosens a single bucket.
List every public IP and hostname you own: load balancers, instances, databases, every record in your DNS zone.
Check them from outside, with a port scanner you are authorized to run against your own addresses, or by looking up what Shodan already lists.
Name the reason each open port is open. Close the ones without one.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
DNS for App Builders: Records, TTLs, the Apex Problem, and Why "Propagation" Is Caching
What each DNS record does, why you cannot put a CNAME on your bare domain, why DNS changes seem to take hours, and how to stop the domain itself becoming your single point of failure. With Route 53 prices and the January 2025 switch from WHOIS to RDAP.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.