"Bad" TCP/UDP Ports List

The list below shows default ports. Many of these programs may be configured to operate on other ports. A much more complete list can be found at the Simovits Consulting Web site at http://www.simovits.com/nyheter9902.html or at Raf Vantongerloo's page at http://home.tiscalinet.be/bchicken/trojans/trojanpo.htm.

31/tcpAgent 31, Hackers Paradise, Masters Paradise
1170/tcpPsyber Stream
1234/tcpUltors Trojan
1243/tcpSubSeven server (default for V1.0-2.0)
2001/tcpTrojan Cow
2023/tcpRipper Pro
2140/udpDeep Throat, Invasor
2989/tcpRat backdoor
3150/tcpDeep Throat, Invasor
3700/tcpPortal of Doom
4950/tcpICQ Trojan
6400/tcpThe Thing
6667/tcpTrinity intruder-to-master and master-to-daemon
SubSeven server (default for V2.1 Icqfix and beyond)
6670/tcpDeep Throat
12345/tcpNetBus 1.x, GabanBus, Pie Bill Gates, X-Bill
12346/tcpNetBus 1.x
16660/tcpStacheldraht intruder-to-master
18753/udpShaft master-to-daemon
20034/tcpNetBus 2 Pro
20432/tcpShaft intruder-to-master
20433/udpShaft daemon-to-master
27374/tcpSubSeven server (default for V2.1-Defcon)
27444/udpTrinoo master-to-daemon
27665/tcpTrinoo intruder-to-master
31335/udpTrinoo daemon-to-master
31337/tcpBack Orifice, Baron Night, Bo Facil
33270/tcpTrinity master-to-daemon
33567/tcpBackdoor rootshell via inetd (from Lion worm)
33568/tcpTrojaned version of SSH (from Lion worm)
40421/tcpMasters Paradise Trojan horse
60008/tcpBackdoor rootshel via inetd (from Lion worm)
65000/tcpStacheldraht master-to-daemon