hostnamemasked:~ TRT$ sudo nmap -sS -A 10.4.146.188
Password:

Starting Nmap 6.47 ( http://nmap.org ) at 2015-08-23 12:39 MYT
Nmap scan report for 10.4.146.188
Host is up (0.00023s latency).
Not shown: 992 filtered ports
PORT     STATE SERVICE            VERSION
88/tcp   open  kerberos-sec       Heimdal Kerberos (server time: 2015-08-23 04:39:41Z)
106/tcp  open  pop3pw             ApplePasswordServer pop3 password change daemon 10.9.0.0
389/tcp  open  ldap               OpenLDAP 2.2.X - 2.3.X
464/tcp  open  kpasswd5?
625/tcp  open  apple-xsrvr-admin?
636/tcp  open  ssl/ldap           OpenLDAP 2.2.X - 2.3.X
| ssl-cert: Subject: commonName=hostnamemasked.private/countryName=US
| Not valid before: 2014-05-20T06:19:43+00:00
|_Not valid after:  2016-05-20T06:19:43+00:00
|_ssl-date: 2015-08-23T04:41:43+00:00; 0s from local time.
| sslv2: 
|   SSLv2 supported
|   ciphers: 
|     SSL2_DES_192_EDE3_CBC_WITH_MD5
|     SSL2_RC2_CBC_128_CBC_WITH_MD5
|     SSL2_RC4_128_WITH_MD5
|     SSL2_DES_64_CBC_WITH_MD5
|     SSL2_RC2_CBC_128_CBC_WITH_MD5
|_    SSL2_RC4_128_EXPORT40_WITH_MD5
749/tcp  open  kerberos-adm?
3659/tcp open  pop3pw             ApplePasswordServer pop3 password change daemon 10.9.0.0
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port464-TCP:V=6.47%I=7%D=8/23%Time=55D94E92%P=x86_64-apple-darwin10.8.0
SF:%r(Kerberos,4,"\0\0\0\0")%r(SMBProgNeg,4,"\0\0\0\0");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|media device
Running: Apple Mac OS X 10.8.X|10.9.X, Apple iOS 5.X
OS CPE: cpe:/o:apple:mac_os_x:10.8 cpe:/o:apple:iphone_os:5 cpe:/o:apple:mac_os_x:10.9
OS details: Apple Mac OS X 10.8 (Mountain Lion) - 10.9 (Mavericks) (Darwin 12.0.0 - 13.0.0) or iOS 5.0.1, Apple Mac OS X 10.9 (Mavericks) (Darwin 13.0.0)
Network Distance: 0 hops

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 161.46 seconds