0

I am trying to determine why nmap would show different results when I am connected to a VPN service.

When I am connected to Nord VPN, it shows two additional ports which do not seem to be open.

No VPN

root@localhost:~# nmap dewalt.com
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-24 02:08 UTC
Nmap scan report for dewalt.com (23.10.143.98)
Host is up (0.0018s latency).
rDNS record for 23.10.143.98: a23-10-143-98.deploy.static.akamaitechnologies.com
Not shown: 998 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 4.82 seconds

Connected to Nord VPN

root@localhost:~# nordvpn connect
Connecting to United States #6733 (us6733.nordvpn.com)
You are connected to United States #6733 (us6733.nordvpn.com)!

root@localhost:~# nmap dewalt.com
Starting Nmap 7.80 ( https://nmap.org ) at 2021-05-24 02:10 UTC
Nmap scan report for dewalt.com (104.95.44.203)
Host is up (0.037s latency).
rDNS record for 104.95.44.203: a104-95-44-203.deploy.static.akamaitechnologies.com
Not shown: 996 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
5060/tcp open  sip
8080/tcp open  http-proxy

Nmap done: 1 IP address (1 host up) scanned in 6.11 seconds
Improve this question
3
  • To make sure you are talking to the same server, always use the IP, not the domain name.
    – ThoriumBR
    May 24, 2021 at 9:52
  • This is not a security question. This is a pure networking question.
    – schroeder ♦
    May 24, 2021 at 11:58
  • I have the same issue when using nmap through nordvpn (going to an IP address and not a domain). I think nordvpn is proxying the connection for 5060 and 8080, hence you receive a syn/ack because you hit their proxy
    – brakertech
    Nov 24, 2021 at 19:21

3 Answers 3

Reset to default
1 
Nmap scan report for dewalt.com (23.10.143.98)
...
Nmap scan report for dewalt.com (104.95.44.203)

Looks like you are scanning different systems here (look at the IP address).

Probably the DNS for the domain is setup in a way to return different IP address depending on where the requests comes from, so that the user gets its "nearest" system for best connectivity. And these can all be systems with different setups.

Improve this answer
1

Take a look at the IP addresses of dewalt.com in both the cases.

They are different.

So, what's happening is that your default DNS (which is setup for your home connection) is getting a server A that is "shortest distance" away from your device.

When you do it after the VPN connection, your public IP (visible to the rest of the world) is the one that VPN server assigns to you. Now, the lookup for dewalt.com will be rerouted through that IP. So, the DNS server which is near that VPN will do the lookup for dewalt.com and the "shortest path" will be with respect to that device.

So, all in all, you are making a connection to a different dewalt.com server in both the cases and its very likely that both servers have different ports open for different services and connections.

Improve this answer
0

In addition to the other answers, noting the change in IP addresses between the two scans, from the rDNS records returned, it looks like you're not actually scanning a host belonging to dewalt, instead you're scanning two different Akamai servers.

Akamai provides traffic management services (e.g. Caching, DoS protection) for a wide range of websites, so often your connection will terminate on their services.

My guess on the port scan would be that the specific Akamai node you hit the second time is providing services for customers who run applications on the other ports noted.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .