Subdomain Port/Service Exposure Scan

Port-probes every subdomain the background crawl discovers against a curated list of database/admin/remote-access ports — flags anything reachable from the open internet.