diff --git a/app/services/realtime_audit_service.py b/app/services/realtime_audit_service.py
index 41be221..8a3b823 100644
--- a/app/services/realtime_audit_service.py
+++ b/app/services/realtime_audit_service.py
@@ -97,27 +97,20 @@ def _ordered_suffixes(hostname):
 
 
 def _resolve(hostname):
-    # 1. Essaie d'abord le FQDN stocké en base (issu de Qualys ou iTop)
+    # 1. FQDN stocke en base - retour direct sans check port (rapide)
     try:
-        from .secrets_service import get_secret  # noqa
         from ..database import SessionLocal
         db = SessionLocal()
-        row = db.execute(text("SELECT fqdn FROM servers WHERE LOWER(hostname)=LOWER(:h) AND fqdn IS NOT NULL AND fqdn != ''"),
-                         {"h": hostname}).fetchone()
+        row = db.execute(text(
+            "SELECT fqdn FROM servers WHERE LOWER(hostname)=LOWER(:h) "
+            "AND fqdn IS NOT NULL AND fqdn != ''"
+        ), {"h": hostname}).fetchone()
         db.close()
         if row and row.fqdn:
-            try:
-                sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-                sock.settimeout(2)
-                r = sock.connect_ex((row.fqdn, 22))
-                sock.close()
-                if r == 0:
-                    return row.fqdn
-            except Exception:
-                pass
+            return row.fqdn
     except Exception:
         pass
-    # 2. Fallback : boucle sur les suffixes DNS
+    # 2. Fallback : boucle suffixes DNS (si FQDN manquant en base)
     for suffix in _ordered_suffixes(hostname):
         target = hostname + suffix
         try: