TCP connectivity check from our server (single host, ≤10 ports, rate-limited). Internal/private addresses are blocked.
