Common Ports and their Services/Trojans
Well... I was looing around my computer today and I found this file on it... I hope its useful for someone here on AO :)
FTP 21/tcp Back Construction, Blade Runner, Doly Trojan, Fore, FTP trojan, Invisible FTP, Larva, WebEx, WinCrash
TELNET 23/tcp Tiny Telnet Server (= TTS)
SMTP 25/tcp Ajan, Antigen, Email Password Sender, Haebu Coceda (= Naebi), Happy 99, Kuang2, ProMail trojan, Shtrilitz, Stealth, Tapiras, Terminator, WinPC, WinSpy
tcp19 19/tcp Chargen
tcp31 31/tcp Agent 31, Hackers Paradise, Masters Paradise
tcp41 41/tcp Deep Throat Info
tcp53 53/tcp DNS
tcp58 58/tcp DM Setup
tcp59 59/tcp DMSetup
tcp79 79/tcp Firehotcker
tcp80 80/tcp Executor, RingZero
tcp98 98/tcp TAC News, linuxconf
tcp99 99/tcp Hidden Port
tcp110 110/tcp ProMail trojan
tcp113 113/tcp [auth] Kazimas
tcp119 119/tcp Happy 99
tcp121 121/tcp Jammer Killah
tcp129 129/tcp Password Generator Protocol
udp135 135/udp Netbios Remote procedure call
udp137 137/udp Netbios name (DoS attacks)
tcp138 138/tcp Netbios datagram (DoS attacks)
udp138 138/udp Netbios datagram
tcp139 139/tcp Netbios session (DoS attacks)
udp139 139/udp Netbios session (DoS attacks)
tcp421 421/tcp TCP Wrappers
tcp456 456/tcp Hacker's Paradise
tcp531 531/tcp Rasmin
tcp555 555/tcp Ini-Killer, NeTAdmin, Phase Zero, Stealth Spy
tcp666 666/tcp Attack FTP, Back Construction, Cain & Abel, Satanz Backdoor, ServeU, Shadow Phyre
tcp911 911/tcp Dark Shadow
tcp999 999/tcp DeepThroat, WinSatan
tcp1001 1001/tcp Silencer, WebEx
tcp1010 1010/tcp Doly Trojan
tcp1011 1011/tcp Doly Trojan
tcp1012 1012/tcp Doly Trojan
tcp1015 1015/tcp Doly Trojan
tcp1024 1024/tcp NetSpy
tcp1027 1027/tcp ICQ
tcp1029 1029/tcp ICQ
tcp1032 1032/tcp ICQ
tcp1042 1042/tcp Bla
tcp1045 1045/tcp Rasmin
tcp1080 1080/tcp Socks/Wingate (Used to detect Wingate sniffers)
tcp1090 1090/tcp Xtreme
tcp1170 1170/tcp Psyber Stream Server, Streaming Audio trojan, Voice
tcp1234 1234/tcp Ultors Trojan
tcp1243 1243/tcp BackDoor-G, SubSeven, SubSeven Apocalypse
tcp1245 1245/tcp VooDoo Doll
tcp1269 1269/tcp Maverick's Matrix
udp1349 1349/udp BackOrifice DLL Comm
tcp1492 1492/tcp FTP99CMP
tcp1509 1509/tcp Psyber Streaming Server
tcp1600 1600/tcp Shivka-Burka
tcp1807 1807/tcp SpySender
tcp1981 1981/tcp Shockrave
tcp1999 1999/tcp BackDoor, TransScout
tcp2000 2000/tcp Remote Explorer, TransScout
tcp2001 2001/tcp TransScout, Trojan Cow
tcp2002 2002/tcp TransScout
tcp2003 2003/tcp TransScout
tcp2004 2004/tcp TransScout
tcp2005 2005/tcp TransScout
tcp2023 2023/tcp Ripper
tcp2086 2086/tcp Netscape/Corba exploit
tcp2115 2115/tcp Bugs
tcp2140 2140/tcp Deep Throat, The Invasor
udp2140 2140/udp Deep Throat
tcp2155 2155/tcp Illusion Mailer
tcp2283 2283/tcp HLV Rat5
tcp2565 2565/tcp Striker
tcp2583 2583/tcp WinCrash
tcp2600 2600/tcp Digital RootBeer
tcp2801 2801/tcp Phineas Phucker
udp2989 2989/udp RAT
tcp3024 3024/tcp WinCrash
tcp3028 3028/tcp Ring Zero
tcp3128 3128/tcp RingZero
tcp3129 3129/tcp Master's Paradise
tcp3150 3150/tcp Deep Throat, The Invasor
udp3150 3150/udp Deep Throat
tcp3459 3459/tcp Eclipse 2000
tcp3700 3700/tcp Portal of Doom
tcp3791 3791/tcp Eclypse
udp3801 3801/udp Eclypse
tcp4092 4092/tcp WinCrash
tcp4321 4321/tcp BoBo
tcp4567 4567/tcp File Nail
tcp4590 4590/tcp ICQ Trojan
tcp5000 5000/tcp Bubbel, Back Door Setup, Sockets de Troie
tcp5001 5001/tcp Back Door Setup, Sockets de Troie
tcp5011 5011/tcp One of the Last Trojans (OOTLT)
tcp5031 5031/tcp NetMetro
tcp5321 5321/tcp Firehotcker
tcp5400 5400/tcp Blade Runner, Back Construction
tcp5401 5401/tcp Blade Runner, Back Construction
tcp5402 5402/tcp Blade Runner, Back Construction
tcp5512 5512/tcp Illusion Mailer, Xtcp
tcp5550 5550/tcp Xtcp
tcp5555 5555/tcp ServeMe
tcp5556 5556/tcp BO Facil
tcp5557 5557/tcp BO Facil
tcp5569 5569/tcp Robo-Hack
tcp5742 5742/tcp WinCrash
tcp6400 6400/tcp The Thing
tcp6669 6669/tcp Vampyre
tcp6670 6670/tcp Deep Throat
tcp6671 6671/tcp Deep Throat
tcp6711 6711/tcp Sub Seven
tcp6712 6712/tcp Sub Seven
tcp6713 6713/tcp Sub Seven
tcp6771 6771/tcp Deep Throat
tcp6776 6776/tcp BackDoor-G, SubSeven
tcp6912 6912/tcp **** Heep (not port 69123!)
tcp6939 6939/tcp Indoctrination
tcp6969 6969/tcp GateCrasher, Priority, IRC 3
tcp6970 6970/tcp Gate Crasher
tcp7000 7000/tcp Remote Grab, Kazimas
tcp7300 7300/tcp Net Monitor
tcp7301 7301/tcp Net Monitor
tcp7306 7306/tcp Net Monitor
tcp7307 7307/tcp Net Monitor
tcp7308 7308/tcp Net Monitor
tcp7789 7789/tcp Back Door Setup, ICKiller
tcp8080 8080/tcp Ring Zero
tcp9400 9400/tcp InCommand
tcp9872 9872/tcp Portal of Doom
tcp9873 9873/tcp Portal of Doom
tcp9874 9874/tcp Portal of Doom
tcp9875 9875/tcp Portal of Doom
tcp9876 9876/tcp Cyber Attacker
tcp9878 9878/tcp Trans Scout
tcp9989 9989/tcp iNi-Killer
tcp10067 10067/tcp Portal of Doom
udp1006710067/udp Portal of Doom
tcp10101 10101/tcp BrainSpy
tcp10167 10167/tcp Portal of Doom
udp1016710167/udp Portal of Doom
tcp10520 10520/tcp Acid Shivers
tcp10607 10607/tcp Coma
tcp11000 11000/tcp Senna Spy
tcp11223 11223/tcp Progenic Trojan
tcp12076 12076/tcp GJamer
tcp12223 12223/tcp Hack-99 KeyLogger
tcp12345 12345/tcp GabanBus, NetBus, Pie Bill Gates, X-bill, Ultor's Trojan
tcp12346 12346/tcp GabanBus, NetBus, X-bill
tcp12361 12361/tcp Whack-a-mole
tcp12362 12362/tcp Whack-a-mole
tcp12456 12456/tcp NetBus
tcp12631 12631/tcp Whack Job
tcp13000 13000/tcp Senna Spy
tcp16969 16969/tcp Priority
tcp17300 17300/tcp Kuang2 The Virus
tcp20000 20000/tcp Millennium
tcp20001 20001/tcp Millennium
tcp20034 20034/tcp NetBus 2 Pro
tcp20203 20203/tcp Logged
tcp21544 21544/tcp GirlFriend
tcp21554 21554/tcp GirlFriend
tcp22222 22222/tcp Prosiak
tcp23456 23456/tcp Evil FTP, Ugly FTP, Whack Job
tcp23476 23476/tcp Donald Dick
tcp23477 23477/tcp Donald Dick
tcp26274 26274/tcp Delta Source
udp26274 26274/udp Delta Source
udp27374 27374/udp Sub-7 2.1
udp27444 27444/udp Trinoo Daemon (denial of service)
tcp27573 27573/tcp Sub-7 2.1
udp27573 27573/udp Sub-7 2.1
tcp27665 27665/tcp Trinoo Master (denial of service)
tcp29891 29891/tcp The Unexplained
udp29891 29891/udp The Unexplained
tcp30029 30029/tcp AOL Trojan
tcp30100 30100/tcp NetSphere
tcp30101 30101/tcp NetSphere
tcp30102 30102/tcp NetSphere
tcp30303 30303/tcp Sockets de Troie
tcp30999 30999/tcp Kuang2
udp3133531335/udp Trinoo Master (denial of service)
tcp31336 31336/tcp Bo Whack
tcp31337 31337/tcp Baron Night, BO client, BO2, Bo Facil, Netpatch
udp3133731337/udp BackFire, Back Orifice, DeepBO
tcp31338 31338/tcp NetSpy DK
udp31338 31338/udp Back Orifice, DeepBO
tcp31339 31339/tcp NetSpy DK
tcp31666 31666/tcp BOWhack
tcp31785 31785/tcp Hack-a-Tack
tcp31787 31787/tcp Hack-a-Tack
tcp31788 31788/tcp Hack-a-Tack
udp31789 31789/udp Hack-a-Tack
udp31791 31791/udp Hack-a-Tack
tcp31792 31792/tcp Hack-a-Tack
tcp33333 33333/tcp Prosiak
udp33390 33390/udp Unknown trojan
tcp33911 33911/tcp Spirit 2001 a
tcp34324 34324/tcp BigGluck, TN
udp34555 34555/udp unnamed DDOS tool Master->Client (Trinoo offshoot)
udp35555 35555/udp unnamed DDOS tool Client->Master (Trinoo offshoot)
tcp40412 40412/tcp The Spy
tcp40421 40421/tcp Agent 40421, Masters Paradise
tcp40422 40422/tcp Master's Paradise
tcp40423 40423/tcp Master's Paradise
tcp40425 40425/tcp Master's Paradise
tcp40426 40426/tcp Masters Paradise
tcp47252 47252/tcp Delta Source
udp47262 47262/udp Delta Source
tcp50505 50505/tcp Detects & blocks Sokets de Trois v2.
tcp50766 50766/tcp Fore, Schwindler
tcp53001 53001/tcp Remote Windows Shutdown
tcp54320 54320/tcp Back Orifice 2000
udp54320 54320/udp Back Orifice
tcp54321 54321/tcp School Bus, Back Orifice
udp54321 54321/udp Back Orifice 2000
tcp60000 60000/tcp Deep Throat
tcp61466 61466/tcp Telecommando
tcp65000 65000/tcp Devil
