The internet is a 24/7 grand census. Multiple specialized engines (Shodan, Censys, BinaryEdge, ZoomEye, plus thousands of independent botnets) sweep the entire IPv4 space, port by port, looking for anything that responds. Standing up a fresh VPS with port 22 open will see SSH probes within minutes — not hours.
What scans look like in practice
| Surface | Time-to-first-probe (typical) | What they try |
|---|---|---|
| Port 22 (SSH) on a fresh public IP | Seconds to minutes | root + 10K most-common passwords |
| Port 80/443 with no host header check | Minutes | WordPress paths, .env probes, exposed dashboards |
| Port 11434 (Ollama default) | Days to weeks | Direct API calls to drain your model on someone else's prompts |
Port 5432 (Postgres) with default postgres user | Hours | Empty-password and "postgres/postgres" attempts |
| An open S3 bucket / MinIO endpoint | Hours to days | Bucket enumeration tools find them via DNS patterns |
Why "security through obscurity" almost always fails
- Random ports — Scanners sweep all 65,535 ports routinely; "I moved SSH to 2222" delays discovery by hours, not weeks.
- Long subdomains — Certificate Transparency logs publish every TLS cert issued. Subdomain "secrecy" is broken the moment you get a Let's Encrypt cert.
- Unguessable paths — A Google indexer or a referer leak exposes them; one log file with a mistyped path is enough.