| 7 | Echo ProtocolAttacked | tcp, udp | Well-known |
| 19 | CharGEN (Character Generator Protocol)Attacked | udp, tcp | Well-known |
| 20 | FTP (File Transfer Protocol) data channelAttacked | tcp | Well-known |
| 21 | FTP (File Transfer Protocol) control channelAttacked | tcp | Well-known |
| 22 | SSH (Secure Shell)Attacked | tcp | Well-known |
| 23 | TelnetAttacked | tcp | Well-known |
| 25 | SMTP (Simple Mail Transfer Protocol)Attacked | tcp | Well-known |
| 53 | DNS (Domain Name System)Attacked | tcp, udp | Well-known |
| 67 | DHCP (Dynamic Host Configuration Protocol) serverAttacked | udp | Well-known |
| 69 | TFTP (Trivial File Transfer Protocol)Attacked | udp | Well-known |
| 79 | FingerAttacked | tcp | Well-known |
| 80 | HTTP (Hypertext Transfer Protocol)Attacked | tcp | Well-known |
| 88 | KerberosAttacked | tcp, udp | Well-known |
| 110 | POP3 (Post Office Protocol v3)Attacked | tcp | Well-known |
| 111 | RPCbind (portmapper)Attacked | tcp, udp | Well-known |
| 113 | Ident / AuthAttacked | tcp | Well-known |
| 119 | NNTP (Network News Transfer Protocol)Attacked | tcp | Well-known |
| 123 | NTP (Network Time Protocol)Attacked | udp | Well-known |
| 135 | MSRPC Endpoint MapperAttacked | tcp | Well-known |
| 137 | NetBIOS Name Service (NBT-NS)Attacked | udp | Well-known |
| 139 | NetBIOS Session ServiceAttacked | tcp | Well-known |
| 143 | IMAP (Internet Message Access Protocol)Attacked | tcp | Well-known |
| 161 | SNMP (Simple Network Management Protocol)Attacked | udp | Well-known |
| 179 | BGP (Border Gateway Protocol)Attacked | tcp | Well-known |
| 194 | IRC (Internet Relay Chat)Attacked | tcp | Well-known |
| 389 | LDAP (Lightweight Directory Access Protocol)Attacked | tcp, udp | Well-known |
| 427 | SLP (Service Location Protocol)Attacked | udp, tcp | Well-known |
| 443 | HTTPS (HTTP over TLS)Attacked | tcp | Well-known |
| 445 | SMB / CIFSAttacked | tcp | Well-known |
| 465 | SMTPS (SMTP Submission over implicit TLS) | tcp | Well-known |
| 500 | IKE / ISAKMP (IPsec VPN key exchange)Attacked | udp | Well-known |
| 514 | SyslogAttacked | udp | Well-known |
| 515 | LPD (Line Printer Daemon)Attacked | tcp | Well-known |
| 520 | RIP (Routing Information Protocol)Attacked | udp | Well-known |
| 548 | AFP (Apple Filing Protocol)Attacked | tcp | Well-known |
| 554 | RTSP (Real Time Streaming Protocol)Attacked | tcp | Well-known |
| 587 | SMTP Submission (STARTTLS) | tcp | Well-known |
| 593 | RPC over HTTP (MSRPC/EPMAP)Attacked | tcp | Well-known |
| 623 | IPMI / RMCP (BMC out-of-band management)Attacked | udp | Registered |
| 631 | IPP / CUPS (Internet Printing Protocol)Attacked | tcp, udp | Well-known |
| 636 | LDAPS (LDAP over TLS)Attacked | tcp | Well-known |
| 873 | rsync daemonAttacked | tcp | Well-known |
| 990 | FTPS (FTP over implicit TLS)Attacked | tcp | Well-known |
| 993 | IMAPS (IMAP over TLS) | tcp | Well-known |
| 995 | POP3S (POP3 over TLS) | tcp | Well-known |
| 1080 | SOCKS proxyAttacked | tcp | Registered |
| 1099 | Java RMI RegistryAttacked | tcp | Registered |
| 1194 | OpenVPNAttacked | udp, tcp | Registered |
| 1433 | Microsoft SQL ServerAttacked | tcp | Registered |
| 1434 | Microsoft SQL Server Resolution Service (SQL Server Browser)Attacked | udp | Registered |
| 1521 | Oracle Database TNS listenerAttacked | tcp | Registered |
| 1701 | L2TP (VPN)Attacked | udp | Registered |
| 1723 | PPTP (Point-to-Point Tunneling Protocol)Attacked | tcp | Registered |
| 1812 | RADIUS authenticationAttacked | udp | Registered |
| 1900 | SSDP / UPnP (Simple Service Discovery Protocol)Attacked | udp | Registered |
| 2049 | NFS (Network File System)Attacked | tcp | Registered |
| 2181 | Apache ZooKeeperAttacked | tcp | Registered |
| 2375 | Docker Engine API (unencrypted)Attacked | tcp | Registered |
| 2376 | Docker Engine API (TLS)Attacked | tcp | Registered |
| 3128 | Squid HTTP ProxyAttacked | tcp | Registered |
| 3260 | iSCSI targetAttacked | tcp | Registered |
| 3268 | LDAP Global Catalog (Active Directory)Attacked | tcp | Registered |
| 3306 | MySQL / MariaDBAttacked | tcp | Registered |
| 3389 | RDP (Remote Desktop Protocol)Attacked | tcp, udp | Well-known |
| 3478 | STUN / TURN (WebRTC NAT traversal)Attacked | udp, tcp | Registered |
| 3690 | Subversion (svnserve)Attacked | tcp | Registered |
| 4369 | Erlang Port Mapper Daemon (epmd)Attacked | tcp | Registered |
| 4444 | Metasploit Meterpreter (default) / MSRPC BlasterAttacked | tcp | Registered |
| 4500 | IPsec NAT-T (IKE NAT traversal)Attacked | udp | Registered |
| 4505 | SaltStack Salt master (ZeroMQ)Attacked | tcp | Registered |
| 5000 | UPnP / common dev server (Flask, Docker registry)Attacked | tcp | Registered |
| 5060 | SIP (Session Initiation Protocol)Attacked | tcp, udp | Registered |
| 5353 | mDNS (Multicast DNS)Attacked | udp | Registered |
| 5432 | PostgreSQLAttacked | tcp | Registered |
| 5555 | Android Debug Bridge (ADB)Attacked | tcp | Registered |
| 5601 | KibanaAttacked | tcp | Registered |
| 5672 | AMQP (RabbitMQ)Attacked | tcp | Registered |
| 5683 | CoAP (Constrained Application Protocol, IoT)Attacked | udp | Registered |
| 5900 | VNC (Virtual Network Computing)Attacked | tcp | Registered |
| 5984 | Apache CouchDBAttacked | tcp | Registered |
| 5985 | WinRM (HTTP)Attacked | tcp | Registered |
| 5986 | WinRM over HTTPSAttacked | tcp | Registered |
| 6000 | X11 (X Window System)Attacked | tcp | Registered |
| 6379 | RedisAttacked | tcp | Registered |
| 6443 | Kubernetes API serverAttacked | tcp | Registered |
| 6667 | IRC (Internet Relay Chat)Attacked | tcp | Registered |
| 7001 | Oracle WebLogic ServerAttacked | tcp | Registered |
| 7547 | TR-069 / CWMP (CPE WAN Management)Attacked | tcp | Registered |
| 8009 | AJP (Apache JServ Protocol, Tomcat)Attacked | tcp | Registered |
| 8080 | HTTP Alternate / ProxyAttacked | tcp | Registered |
| 8443 | HTTPS Alternate (web admin / Tomcat SSL)Attacked | tcp | Registered |
| 8500 | HashiCorp Consul HTTP APIAttacked | tcp | Registered |
| 9000 | PHP-FPM / SonarQube / dev HTTPAttacked | tcp | Registered |
| 9090 | Prometheus / web adminAttacked | tcp | Registered |
| 9092 | Apache KafkaAttacked | tcp | Registered |
| 9100 | Printer JetDirect (raw print) / node_exporterAttacked | tcp | Registered |
| 9200 | Elasticsearch HTTP APIAttacked | tcp | Registered |
| 9300 | Elasticsearch transport (node-to-node)Attacked | tcp | Registered |
| 9418 | Git protocol (git daemon)Attacked | tcp | Registered |
| 10000 | WebminAttacked | tcp | Registered |
| 10250 | Kubernetes kubelet APIAttacked | tcp | Registered |
| 11211 | MemcachedAttacked | tcp, udp | Registered |
| 27017 | MongoDBAttacked | tcp | Registered |