Directory queries — users, groups, and the organisational structure they sit in. It is the protocol behind Active Directory and OpenLDAP, and behind the 'log in with your company account' flow in a great many internal applications.
Unencrypted by default, so bind credentials can cross the network in the clear. Use LDAPS on 636 or StartTLS, and keep directories off the public internet.
LDAP reachable from the internet exposes a directory of your organisation. Restrict it to internal networks, and use LDAPS or StartTLS for anything crossing a network at all.
The port scanner will tell you whether 389 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.