Single file, no external resources. Served from https://beef.hidtv.hu/ — but a public origin probing 10.x is
exactly what Edge's Local Network Access gate blocks, so if the preflight banner below turns red, use
download and open the file from file:// instead. Over https, only https://
probes and the ports whose scheme is TLS can leave the page; every http:// row is mixed-content blocked.
Hosts, one per line (# comments ignored). Ports are hardcoded in PORTS at the top of the script — edit there, not here.
| host | port | scheme | verdict | ms | service |
|---|
Reading the verdicts. A browser cannot open a raw socket, so each row is what fetch() did:
open the promise resolved — the TCP handshake completed and the service answered, which is hard proof of reach.
refused the promise rejected quickly — usually RST (nothing listening) or DNS failure, sometimes a service that hangs up on a non-HTTP request. Packets were not silently dropped.
no answer nothing came back before the timeout — either a firewall dropped it, or a service is listening that never replies. These two are indistinguishable from a browser.
blocked Edge refuses the port (ERR_UNSAFE_PORT) without emitting a packet. 139, 389, 636, 53, 22 and 23 fall in that set, so SMB and LDAP reach must be tested with scan_targets.sh or the Flipper payload instead.
skipped served over https and the port needs plain http, so the request died as mixed content inside the page — not a network verdict. Use the file:// copy for those ports, or serve this file over plain http.
Preflight. Before scanning, the page fetches itself and then the known-good URL. If the self-fetch works but the known-good URL fails instantly, something is killing cross-origin probes before the wire (Edge Local Network Access, a policy, or a shield) and every verdict below is meaningless. The banner says so rather than letting you read a wall of false "no answer" rows.