Open Port Finding Messages

This port was observed running Apache ZooKeeper, which is an open-source coordination service for distributed systems. It has had vulnerabilities in the past and it and its developers recommend that it should not be deployed on the public Internet. See the Apache ZooKeeper recommendations.

Port: 2181

This port is typically used for Hypertext Transfer Protocol Secure (HTTPS), which is used for sending and receiving secure internet traffic.

Ports:

• 443
• 8443

This port is typically used for Internet Message Access Protocol Secure (IMAPS), which is used for securing IMAP.

Port: 993

This port is typically used for IPSec, which is used for securing IP communications.

Port: 4500

This port is typically used for Post Office Protocol version 3 secure (POP3S), which is used for securing POP3.

Port: 995

This port is typically used for Simple Mail Transfer Protocol Secure (SMTPS), which is used for securing SMTP.

Port: 465

This port is typically used for Secure Shell (SSH), which is used for sending and receiving secure communication.

Port: 22

This port is typically used for Telnet over Transport Layer Security (TLS)/Secure Sockets Layer (SSL), which is used for securing Telnet.

Port: 992

This port is typically used for Active Directory, which is a directory service for Windows domain networks.

Port: 445

This port is typically used for the Advanced Messaging Queuing Protocol (AMQP), which is used for sending messages between distributed systems.

Port: 5672

This port is typically used for Alert Standard Format-Remote Management and Control Protocol (ASF-RMCP), which can be used to obtain password hash information.

Port: 623

This port is typically used for Building Automation and Control Networks (BACNet), which is a communications protocol for building automation. These devices should not be exposed to the Internet.

Port: 47808

This port is typically used for the Bandwidth Test service, which is used to measure packet throughput on certain network routers.

Port: 2000

This port is typically used for BitTorrent Tracker, which is used to help BitTorrent clients find each other and share files. File sharing is a known vector for malware to enter otherwise secure systems.

Port: 69

This port is typically used for the Bootstrap protocol, which is used to automatically assign IP addresses to devices on a network.

Port: 67

This port is typically used for Chargen, which returns arbitrary characters until the connection is closed. This protocol has known design flaws and is commonly used in Distributed Denial of Service (DDoS) attacks. This protocol should not be exposed to the Internet.

Port: 19

This port is typically used for CouchDB, which is a document-oriented NoSQL database.

Port: 5984

This port is typically used for cPanel, which is a web hosting control panel.

Ports:

• 2082
• 2083

This port is typically used for cPanel, which is a web hosting control panel.

Ports:

• 2086
• 2087

This port is typically used for the Daytime protocol (RFC-867), which returns the current date and time. It can be used for “pingpong” attacks. This protocol should not be exposed to the Internet. If the time is incorrect, it can be exploited by attackers to break secure connections and encryption certificates. The Daytime daemon is also not recommended for new users. Its format is backwards compatible, but does not support robust error detection or correction and has poor error-handling capabilities. Many of the client programs that use this format are poorly written and may not handle network errors properly.

Port: 13

This port was observed running a Distributed Hash Table (DHT), which is used to help BitTorrent nodes find each other and connect peers for file sharing.

Port: 6881

This port is typically used for the Dictionary network protocol, which returns dictionary definitions of words. It can be used maliciously for Distributed Denial of Service (DDoS) attacks.

Port: 2628

This port is typically used for Domain Name System (DNS), which is necessary for accessing websites.

Port: 53

This port is typically used for the Echo protocol, which measures the round trip times in networks. This protocol should not be exposed to the Internet. It is superseded by the Internet Control Message Protocol (ICMP) and the Ping Software Utility.

Port: 7

This port is typically used for Erlang Port Mapper Daemon, which facilitates communications between Erlang nodes.

Port: 4369

This port is typically used for EtherNet/IP, which in an industrial Ethernet network. It has known vulnerabilities. These devices should not be exposed to the Internet.

Port: 44818

This port is typically used for the Extract, Transform, Load (ETL) Service Manager.

Port: 9001

This port is typically used for the Finger protocol, which returns status reports about systems or users and can be used to gather information for social engineering attacks. This protocol should not be exposed to the Internet.

Port: 79

This port is typically used for Flux LED internet-connected light bulbs. Internet-of-Things (IoT) devices may leak sensitive information such as wireless network passwords or lead to other compromises.

Port: 5577

This port is typically used for File Transfer Protocol (FTP), which is used to transfer files over a network.

Port: 21

This port is typically used for the General Packet Radio Service (GPRS) Tunneling protocol, which is used to carry general packet radio services.

Port: 2123

This port is typically used for Hypertext Transfer Protocol (HTTP), which is used for sending and receiving internet traffic.

Ports:

• 80
• 81
• 82
• 8080

This port is typically used for IBM Network Job Entry (NJE), which is used to send work to machines over a network.

Port: 175

This port is typically used for International Electrotechnical Commission (IEC) 60870-5-104, which enables communication between control stations and substations via a Transmission Control Protocol (TCP)/Internet Protocol (IP) network. It can be used maliciously for man-in-the-middle (MITM) attacks.

Port: 2404

This port is typically used for Internet Message Access Protocol (IMAP), which is a commonly used mail protocol.

Port: 143

This port is typically used for the Internet Printing Protocol (IPP), which allows for remote printing. This protocol has known vulnerabilities.

Port: 631

This port is typically used for Internet Relay Chat (IRC), which is a chat protocol.

Port: 6666

This port is typically used for Internet Security Association and Key Management Protocol (ISAKMP), which is used for establishing Security Associations and cryptographic keys.

Port: 500

This port is typically used for ISO-Transport Services Access Point (ISO-TSAP), which does not encrypt traffic. This protocol should not be exposed to the Internet.

Port: 102

This port is typically used for Java Remote Method Invocation (RMI) or a Java RMI Server, which is the equivalent of Remote Procedure Calls (RPC) for the Java language. The default configuration of Java RMI servers allow loading classes from any remote Hypertext Transfer Protocol (HTTP) URL, which is considered insecure.

Port: 1099

This port is typically used for the Kerberos protocol, which is used for secure authentication.

Port: 88

This port is typically used for Lightweight Directory Access Protocol (LDAP), which is used to maintain directory information service and can be used to gather information about a company's network infrastructure.

Port: 389

This port is running an Lightweight Directory Access Protocol (LDAP) server. This can be exploited to harvest directory information.

Port: 636

This port is typically used for line printer daemon, which is a protocol for submitting print jobs to remote printers. This service should not be exposed to the Internet.

Port: 515

This port is typically used for Memcached, which is a memory caching system. It has known security vulnerabilities.

Port: 11211

This port is typically used for Modbus, which is a protocol used for communication between devices on the same network. It does not provide security against unauthorized commands or interception of data.

Port: 502

This port is typically used for Microsoft Simple Service Discovery Protocol (SSDP), which is a network protocol for the advertisement and discovery of network services and presence information. It can be used maliciously for Distributed Denial of Service (DDoS) attacks.

Port: 1900

This port is typically used for MySQL, which is an open source Structured Query Language (SQL) database. It has many known security vulnerabilities.

Port: 3306

This port is typically used for Microsoft Structured Query Language (SQL) Server, which has many known vulnerabilities.

Port: 1434

This port is typically used for Mumble, which is an encrypted voice-over-IP (VoIP) application.

Port: 64738

This port is typically used for the Munin Graphing framework, which monitors networks and issues alerts.

Port: 4949

This port is typically used for Nessus, which is a vulnerability scanner.

Port: 8834

This port is typically used for Network Basic Input/Output System (NetBIOS), which allows applications on different computers to communicate over a Local Area Network (LAN). It has known security vulnerabilities and is a common attack target.

Port: 137

This port is typically used for Netstat, which is a deprecated tool used to monitor network performance.

Port: 15

This port is typically used for Network Data Management Protocol (NDMP), which transports data between network attached storage devices and backup devices. It does not encrypt traffic. These devices should not be exposed to the Internet.

Port: 10000

This port is typically used for Network News Transfer Protocol (NNTP), which is used to transport Usenet articles and has known vulnerabilities.

Port: 119

This port is typically used for Network Time Protocol (NTP), which is used for clock synchronization.

Port: 123

This port is typically used for Open Network Computing (ONC) Remote Procedure Call (RPC), which allows programmers to execute code on remote machines.

Port: 111

This port is typically used for Oracle Structured Query Language (SQL), which has many known security vulnerabilities.

Port: 5560

This port is typically used for pcAnywhere, which allows a user to connect to another computer over a network connection. It has known vulnerabilities and is no longer supported.

Port: 5632

This port is typically used for Post Office Protocol (POP), which is a commonly used mail protocol.

Port: 110

This port is typically used for PostgreSQL, which is an object-relational database management system. It has known security vulnerabilities.

Port: 5432

This port is typically used for the Point-to-Point Tunneling Protocol (PPTP), which is a method for implementing Virtual Private Networks (VPN).

Port: 1723

This port is typically used for Printer Page Description Language (PDL), which communicates the layout of a page for printing. This service should not be exposed to the Internet.

Port: 9100

This port is typically used for Quote of the Day, which returns a short message to the user. It can be used for “pingpong” attacks. This protocol should not be exposed to the Internet.

Port: 17

This port is typically used for Redis, which is a data structure server and should not be accessible from the Internet.

Port: 6379

This port is typically used for RSYNC, which is software designed to keep copies of files synchronized on the same or across multiple computers. This service should not be exposed to the Internet.

Port: 873

This port is typically used for the Real Time Streaming Protocol (RTSP) service, which is used to control streaming media servers.

Port: 554

This port is typically used for Supervisory Control and Data Acquisition (SCADA) systems and shouldn't be exposed to the Internet.

Port: 20000

This port is typically used for Session Initiation Protocol (SIP), which is a widely-used communication protocol.

Port: 5060

This port is typically used for Server Message Block (SMB), which is used to share files, devices, printers, and other communications between machines.

Port: 445

This port is typically used for Simple Mail Transfer Protocol (SMTP), which is a commonly used mail protocol.

Port: 25

This port is typically used for Simple Mail Transfer Protocol (SMTP) submission, which specifically supports authentication to Mail Transfer Agents (MTA).

Port: 587

This port is typically used for Simple Network Management Protocol (SNMP), which is a protocol for managing devices on IP networks. It has known security vulnerabilities.

Port: 161

This port is typically used for Simple Network Paging Protocol (SNPP), which allows pagers to receive messages over the Internet.

Port: 444

This port is typically used for Systat, which returns a list of users logged into the system and is typically considered a security vulnerability.

Port: 11

This port is typically used by a Terminal Access Controller Access-Control System (TACACS), which is used for remote authentication and access control through a central server.

Port: 49

This port is typically used for Telnet, a communication protocol that does not encrypt traffic and has known security vulnerabilities.

Port: 23

This port is typically used for the Time protocol (RFC-868), which returns the current date and time. This protocol has known security vulnerabilities. If the time is incorrect, it can be exploited by attackers to break secure connections and encryption certificates. The Time daemon is also not recommended for new users. Its format is backwards compatible, but does not support robust error detection or correction and has poor error-handling capabilities. Many of the client programs that use this format are poorly written and may not handle network errors properly.

Port: 37

This port is typically used for Technical Report 069 (TR-069) CPE WAN Management Protocol (CWMP), which is a protocol for remote management of end-user devices.

Port: 7547

This port is typically used for the Universal Plug-n-Play features (UPnP) protocol, which allows devices to discover each other's presence over a network. It does not implement authentication by default.

Port: 5000

This port is typically used for Ventrilo, which is a voice-over-IP (VoIP) and text chat software.

Port: 3784

This port is typically used for Virtual Network Computing (VNC) system, which is a graphical desktop sharing system. It is not a secure protocol.

Ports:

• 5900
• 5901

This port is typically used for Web Services-Management (WS-Management), which is a Simple Object Access Protocol (SOAP)-based protocol for managing devices and web services.

Ports:

• 5985
• 5986

This port is typically used for Extensible Messaging and Presence Protocol (XMPP), which is an instant messaging protocol.

Port: 5222

This port is typically used for the Microsoft Remote Desktop Protocol (MS RDP), which allows a user to connect to another computer over a network connection. It can be vulnerable to man-in-the-middle (MITM) attacks.

Port: 3389

LibSSH versions 0.6 and above have an authentication bypass vulnerability in the server code, which allows attackers to steal encryption keys, access user data, install rootkits, and erase logs that recorded the unauthorized access. Learn more about CVE-2018-10933.

If observed from October 23, 2018 and onward, this is assessed as “BAD.”

The VPNFilter malware targets small office and home office routers. The malware can collect information passing through the router (such as website credentials), can render an infected device unusable, can be triggered on individual machines or en masse, block network traffic, and has the potential of cutting off internet access worldwide.

Ports:

• 80
• 161
• 443