This counts detected port-scan attempts against a host, where a single source probes many ports on the same destination in a short time window. This is a reconnaissance indicator specifically, distinct from the IP-sweep counter, which covers many hosts on one port: an admin sees this rise when someone is mapping which services are open on a particular protected server, often the step just before a targeted exploit attempt. For example, detecting 200 distinct destination ports probed from one external IP against a single mail server within a minute.