Port ranges: 0–1023 well-known (services), 1024–49151 registered (apps), 49152–65535 dynamic / ephemeral (client source ports, where reverse shells land). A port only suggests a service — malware runs on whatever it likes, most often 443. Confirm with the actual protocol, not the number.
Watch closely
Commonly abused ports
Conventions, not guarantees — but a hit on one of these on an internal host is worth a second look.
4444/tcp Metasploit / MeterpreterDefault Metasploit listener and reverse-shell port. Rarely anything legitimate.5555/tcp Android ADB / RATsExposed ADB is remote code execution; also used by several RATs.6667/tcp IRCClassic botnet C2 channel. 6660–6669 all in play.1080/tcp SOCKS proxyPivoting and traffic relaying through a compromised host.9001/tcp Tor ORTor relay/onion routing; 9030 dir, 9050 local SOCKS. Tor on a workstation is a flag.31337/tcp "elite" / Back OrificeOld-school backdoor port, still used as a calling card.12345/tcp NetBusLegacy RAT; 12346 too.8000/8888/tcp HTTP stagingCommon ad-hoc web servers for payload staging and exfil.49152+/tcp ephemeral / reverse shellsHigh dynamic ports — where a callback shell usually lands. Pair with the process, not the port alone.Web
Web & proxies
80/tcp HTTPCleartext web. Cleartext creds and plenty of C2 still ride here.443/tcp HTTPSTLS web. The default hiding place for modern C2 and exfil.8080/tcp HTTP-alt / proxyDev servers, appliances, and proxies. Watch for internal hosts serving on it.8443/tcp HTTPS-altAlt TLS — management consoles and appliances.3128/tcp Squid proxyProxy port; can be abused for tunneling.Remote access
Remote access & management
22/tcp SSH / SFTPRemote shell and file transfer. Constant brute-force target; watch Accepted from odd IPs.23/tcp TelnetCleartext remote shell. Shouldn't exist in 2026 — IoT botnets (Mirai) live on it.3389/tcp RDPWindows remote desktop. The #1 ransomware entry point when exposed.5900/tcp VNCRemote desktop, often left unauthenticated.5985/tcp WinRM (HTTP)PowerShell remoting. Heavily used for lateral movement.5986/tcp WinRM (HTTPS)Encrypted PowerShell remoting.Windows / AD
Windows & Active Directory
445/tcp SMBFile sharing. EternalBlue, lateral movement, and ransomware spread. The one to watch internally.135/tcp MS RPC / DCOMRPC endpoint mapper. WMI and DCOM lateral movement start here.137-139/tcp+udp NetBIOSLegacy name/session service. 137 name, 138 datagram, 139 session.88/tcp+udp KerberosAD authentication. Kerberoasting and ticket attacks (4768/4769 events).389/tcp+udp LDAPDirectory queries. BloodHound and AD recon hammer this.636/tcp LDAPSLDAP over TLS.3268/3269/tcp Global CatalogForest-wide LDAP; 3269 over TLS.464/tcp+udp kpasswdKerberos password change.49152-65535/tcp dynamic RPCThe high-port range DCOM/RPC negotiates after 135.25/tcp SMTPMail transfer between servers. Spam relays and exfil-over-mail.587/tcp SMTP submissionAuthenticated client send (STARTTLS).465/tcp SMTPSSMTP over implicit TLS.110/tcp POP3Mailbox retrieval, cleartext.995/tcp POP3SPOP3 over TLS.143/tcp IMAPMailbox access, cleartext.993/tcp IMAPSIMAP over TLS.Core services
Core network services
53/tcp+udp DNSName resolution. DNS tunneling and DoH are prime exfil/C2 channels.67/68/udp DHCPAddress assignment. Rogue DHCP = MITM.123/udp NTPTime sync. Amplification DDoS abuses it.161/162/udp SNMPDevice management. Recon goldmine on default community strings; 162 traps.514/udp syslogLog shipping. Spoofed syslog can poison your own logs.5353/udp mDNSMulticast DNS / service discovery on the local segment.179/tcp BGPInter-router routing. Route/BGP hijack territory.File transfer
File transfer
21/tcp FTP controlCleartext file transfer; 20 is the data channel. Creds in the clear.69/udp TFTPNo auth. Network gear config — and malware staging.2049/tcp NFSUnix file shares; often over-permissive exports.873/tcp rsyncBulk sync — a fast exfil path if exposed.Databases
Databases
Databases should almost never be reachable from the internet. One that is, is an incident waiting to happen.
1433/tcp MSSQLMicrosoft SQL Server; 1434/udp is the browser (recon).1521/tcp OracleOracle DB listener.3306/tcp MySQLMySQL / MariaDB.5432/tcp PostgreSQLPostgres.6379/tcp RedisFrequently exposed with no auth — a classic easy compromise.27017/tcp MongoDBHistorically default-open; mass-ransomed when exposed.9200/tcp ElasticsearchREST API; open clusters leak data constantly.11211/tcp+udp memcachedMassive UDP amplification if reachable.VPN / tunnels
VPN & tunneling
500/udp IKE / IPsecVPN key exchange; 4500/udp for NAT traversal.1194/udp OpenVPNOpenVPN default.1723/tcp PPTPLegacy VPN, weak crypto — flag if still in use.51820/udp WireGuardModern VPN default.