| 20 | TCP | ftp-data | FTP data channel for active-mode file transfers.FTP transmits credentials in cleartext. | กลาง |
| 21 | TCP | ftp | File Transfer Protocol control channel.Cleartext credentials; frequently exposed by misconfiguration. | สูง |
| 22 | TCP | ssh | Secure Shell remote login and file transfer (scp/sftp).Constant internet-wide brute-force and botnet login attempts. | กลาง |
| 23 | TCP | telnet | Unencrypted remote terminal session.Cleartext protocol; replace with SSH. | สูง |
| 25 | TCP | smtp | Simple Mail Transfer Protocol message transfer.Open relays are abused for spam. | กลาง |
| 53 | TCP/UDP | domain | DNS name resolution and zone transfers.Open resolvers are used for DNS amplification attacks. | กลาง |
| 67 | UDP | dhcp-server | DHCP server: assigns IP addresses to clients. | ต่ำ |
| 68 | UDP | dhcp-client | DHCP client side of address assignment. | ต่ำ |
| 69 | UDP | tftp | Trivial File Transfer Protocol, used by PXE boot and network gear.No authentication at all. | กลาง |
| 80 | TCP | http | Hypertext Transfer Protocol web traffic. | ต่ำ |
| 88 | TCP/UDP | kerberos | Kerberos authentication for Windows domains.Targeted by Kerberoasting attacks in Active Directory. | กลาง |
| 110 | TCP | pop3 | Post Office Protocol v3 mailbox retrieval.Cleartext unless STARTTLS is enforced. | กลาง |
| 111 | TCP/UDP | rpcbind | ONC RPC port mapper for NFS and related services.Historically exposed in ransomware campaigns. | กลาง |
| 119 | TCP | nntp | Network News Transfer Protocol for Usenet. | ต่ำ |
| 123 | UDP | ntp | Network Time Protocol clock synchronisation.Monlist amplification attacks on open instances. | กลาง |
| 135 | TCP | msrpc | Microsoft RPC endpoint mapper.Classic target for Windows worm and ransomware propagation. | สูง |
| 137 | UDP | netbios-ns | NetBIOS name service.Leaks host information; used in NTLM relay attacks. | กลาง |
| 139 | TCP | netbios-ssn | NetBIOS session service for file and printer sharing.EternalBlue-era target alongside port 445. | สูง |
| 143 | TCP | imap | Internet Message Access Protocol mailbox access.Cleartext unless STARTTLS is enforced. | กลาง |
| 161 | UDP | snmp | Simple Network Management Protocol monitoring.Default community strings expose full device configuration. | สูง |
| 162 | UDP | snmptrap | SNMP trap messages from agents to managers. | ต่ำ |
| 389 | TCP/UDP | ldap | Lightweight Directory Access Protocol.Anonymous binds and LDAP injection risks. | กลาง |
| 443 | TCP | https | HTTP over TLS, encrypted web traffic. | ต่ำ |
| 445 | TCP | microsoft-ds | SMB over TCP for Windows file sharing.WannaCry/EternalBlue propagation and password spraying. | สูง |
| 465 | TCP | smtps | SMTP over implicit TLS message submission. | ต่ำ |
| 514 | UDP | syslog | System logging message transport. | ต่ำ |
| 587 | TCP | submission | Mail message submission with STARTTLS. | ต่ำ |
| 623 | UDP | asf-rmcp | IPMI remote management over LAN.BMC firmware flaws leak password hashes (Rakos, Cipher 0). | สูง |
| 636 | TCP | ldaps | LDAP over TLS. | ต่ำ |
| 873 | TCP | rsync | Rsync file synchronisation daemon.Unauthenticated modules leak and accept arbitrary files. | กลาง |
| 993 | TCP | imaps | IMAP over TLS mailbox access. | ต่ำ |
| 995 | TCP | pop3s | POP3 over TLS mailbox retrieval. | ต่ำ |
| 1080 | TCP | socks | SOCKS proxy protocol.Open proxies are rented for abuse within hours. | กลาง |
| 1194 | UDP | openvpn | OpenVPN tunnel transport. | ต่ำ |
| 1433 | TCP | ms-sql-s | Microsoft SQL Server database.Internet-exposed SQL Server is a top ransomware entry point. | สูง |
| 1521 | TCP | oracle | Oracle database listener.Default accounts and TNS listeners are heavily scanned. | สูง |
| 1723 | TCP | pptp | Point-to-Point Tunnelling Protocol VPN.Broken MS-CHAPv2 authentication; deprecated. | สูง |
| 1883 | TCP | mqtt | MQTT message broker for IoT devices.Anonymous brokers expose device telemetry and control. | กลาง |
| 2049 | TCP/UDP | nfs | Network File System sharing.NO_ROOT_SQUASH exports give instant root. | กลาง |
| 2181 | TCP | zookeeper | Apache ZooKeeper coordination service.Unauthenticated instances expose cluster control. | กลาง |
| 2375 | TCP | docker | Docker Remote API without TLS.Full root-equivalent container control; common cryptominer target. | สูง |
| 2376 | TCP | docker-tls | Docker Remote API over TLS. | กลาง |
| 3268 | TCP | globalcat | Active Directory global catalog over LDAP. | กลาง |
| 3306 | TCP | mysql | MySQL database server.Frequent brute-force target; default root remote access. | สูง |
| 3389 | TCP | ms-wbt-server | Remote Desktop Protocol (RDP).BlueKeep and constant credential-stuffing campaigns. | สูง |
| 5353 | UDP | mdns | Multicast DNS service discovery. | ต่ำ |
| 5432 | TCP | postgresql | PostgreSQL database server.Exposed Postgres instances are brute-forced within minutes. | สูง |
| 5555 | TCP | adb | Android Debug Bridge over TCP.Full device control with no authentication by default. | สูง |
| 5672 | TCP | amqp | Advanced Message Queuing Protocol brokers. | กลาง |
| 5900 | TCP | vnc | Virtual Network Computing remote desktop.Weak or absent authentication; botnets scan it continuously. | สูง |
| 5984 | TCP | couchdb | Apache CouchDB HTTP API.Unauthenticated admin party mode in old versions. | กลาง |
| 5985 | TCP | winrm-http | Windows Remote Management over HTTP.Lateral movement channel in Windows intrusions. | กลาง |
| 6379 | TCP | redis | Redis in-memory data store.Unauthenticated instances allow file writes and RCE. | สูง |
| 6667 | TCP | irc | Internet Relay Chat. | ต่ำ |
| 8080 | TCP | http-proxy | Common alternative HTTP port for apps and proxies.Often serves admin panels without authentication. | กลาง |
| 8443 | TCP | https-alt | Alternative HTTPS port for admin UIs and APIs. | กลาง |
| 8888 | TCP | sun-answerbook | Commonly Jupyter Notebook and HTTP alternatives.Open Jupyter instances execute arbitrary code. | กลาง |
| 9200 | TCP | elasticsearch | Elasticsearch REST API.Unauthenticated instances leak and wipe whole datasets. | สูง |
| 11211 | TCP/UDP | memcached | Memcached memory cache.Amplified into record DDoS floods when exposed (memcrashed). | สูง |
| 27017 | TCP | mongod | MongoDB database.Unauthenticated instances were mass-wiped by Meow attacks. | สูง |
| 50000 | TCP | db2 | IBM Db2 database listener. | กลาง |