{
  "updated": "2026-07-02",
  "count": 150,
  "ports": [
    {
      "port": 7,
      "name": "Echo",
      "protocol": "TCP/UDP",
      "service": "Echo Protocol",
      "category": "Legacy protocols",
      "description": "Port 7 is the Echo Protocol, which simply sends back whatever data it receives. It was designed for testing round-trip network connectivity and is rarely enabled today because it can be abused for denial-of-service amplification.",
      "secure": false
    },
    {
      "port": 9,
      "name": "Discard",
      "protocol": "TCP/UDP",
      "service": "Discard Protocol",
      "category": "Legacy protocols",
      "description": "Port 9 is the Discard Protocol, a service that silently drops any data sent to it. Like other early diagnostic protocols, it was useful for testing but offers no value on a modern network and should stay closed.",
      "secure": false
    },
    {
      "port": 13,
      "name": "Daytime",
      "protocol": "TCP/UDP",
      "service": "Daytime Protocol",
      "category": "Legacy protocols",
      "description": "Port 13 is the Daytime Protocol, which returns the current date and time as human-readable text when a client connects. It predates NTP (port 123) and has been superseded by it for anything that needs accurate time.",
      "secure": false
    },
    {
      "port": 17,
      "name": "QOTD",
      "protocol": "TCP/UDP",
      "service": "Quote of the Day",
      "category": "Legacy protocols",
      "description": "Port 17 is the Quote of the Day protocol, which returns a short text quote to any client that connects. It is a legacy service from the early internet with no practical modern use.",
      "secure": false
    },
    {
      "port": 19,
      "name": "Chargen",
      "protocol": "TCP/UDP",
      "service": "Character Generator Protocol",
      "category": "Legacy protocols",
      "description": "Port 19 is the Character Generator Protocol, which streams a continuous sequence of characters back to the client. It is best known today as a target for UDP amplification attacks, so it should never be exposed to the internet.",
      "secure": false
    },
    {
      "port": 20,
      "name": "FTP-DATA",
      "protocol": "TCP",
      "service": "File Transfer Protocol (data)",
      "category": "File transfer",
      "description": "Port 20 carries the data channel for classic FTP. The control channel on port 21 negotiates transfers, then file bytes flow over port 20 in active mode.",
      "secure": false
    },
    {
      "port": 21,
      "name": "FTP",
      "protocol": "TCP",
      "service": "File Transfer Protocol (control)",
      "category": "File transfer",
      "description": "Port 21 is the FTP control channel, where the client sends commands like USER, PASS, and RETR. Plain FTP is unencrypted, so prefer SFTP (port 22) or FTPS.",
      "secure": false
    },
    {
      "port": 22,
      "name": "SSH",
      "protocol": "TCP",
      "service": "Secure Shell / SFTP / SCP",
      "category": "Remote access",
      "description": "Port 22 is SSH, the encrypted way to open a remote shell, tunnel traffic, and run SFTP or SCP file transfers. It is the default for secure remote administration of Linux and network devices.",
      "secure": true
    },
    {
      "port": 23,
      "name": "Telnet",
      "protocol": "TCP",
      "service": "Telnet remote login",
      "category": "Remote access",
      "description": "Port 23 is Telnet, an old remote-login protocol that sends everything, including passwords, in clear text. It has been replaced by SSH on port 22 and should be disabled where possible.",
      "secure": false
    },
    {
      "port": 25,
      "name": "SMTP",
      "protocol": "TCP",
      "service": "Simple Mail Transfer Protocol",
      "category": "Email",
      "description": "Port 25 is SMTP, used to relay mail between servers. Many providers block it on residential lines to fight spam; mail clients submit outgoing mail on port 587 or 465 instead.",
      "secure": false
    },
    {
      "port": 37,
      "name": "Time Protocol",
      "protocol": "TCP/UDP",
      "service": "Time Protocol",
      "category": "Legacy protocols",
      "description": "Port 37 is the Time Protocol, an early way for a client to fetch the current time from a server as a raw count of seconds since 1900. NTP on port 123 replaced it for anything that needs real accuracy.",
      "secure": false
    },
    {
      "port": 43,
      "name": "WHOIS",
      "protocol": "TCP",
      "service": "WHOIS protocol",
      "category": "Legacy protocols",
      "description": "Port 43 is WHOIS, the protocol registrars and registries use to answer queries about domain name and IP address ownership. Command-line whois clients and lookup websites both connect on this port.",
      "secure": false
    },
    {
      "port": 53,
      "name": "DNS",
      "protocol": "TCP/UDP",
      "service": "Domain Name System",
      "category": "Core services",
      "description": "Port 53 is DNS, which resolves names like example.com into IP addresses. Most lookups use UDP; TCP is used for zone transfers and large responses that do not fit in a single UDP packet.",
      "secure": false
    },
    {
      "port": 67,
      "name": "DHCP",
      "protocol": "UDP",
      "service": "DHCP server (BOOTP)",
      "category": "Core services",
      "description": "Port 67 is where a DHCP server listens for address requests. Clients broadcast from port 68, and the server replies from port 67 with an IP lease, gateway, and DNS settings.",
      "secure": false
    },
    {
      "port": 68,
      "name": "DHCP client",
      "protocol": "UDP",
      "service": "DHCP client (BOOTP)",
      "category": "Core services",
      "description": "Port 68 is the DHCP client port. A device sends its DHCPDISCOVER and DHCPREQUEST from here and receives the lease offer from the server on port 67.",
      "secure": false
    },
    {
      "port": 69,
      "name": "TFTP",
      "protocol": "UDP",
      "service": "Trivial File Transfer Protocol",
      "category": "File transfer",
      "description": "Port 69 is TFTP, a stripped-down file transfer used to load firmware, boot images, and switch configs. It has no authentication, so it is kept to trusted management networks.",
      "secure": false
    },
    {
      "port": 70,
      "name": "Gopher",
      "protocol": "TCP",
      "service": "Gopher protocol",
      "category": "Legacy protocols",
      "description": "Port 70 is Gopher, a menu-driven document retrieval protocol that predates the web. It largely died out after HTTP took over in the 1990s, though a small community still runs Gopher servers today.",
      "secure": false
    },
    {
      "port": 79,
      "name": "Finger",
      "protocol": "TCP",
      "service": "Finger protocol",
      "category": "Legacy protocols",
      "description": "Port 79 is the Finger protocol, which returns basic information about a user on a remote system, such as whether they are logged in. It leaks account details by design and is almost always disabled on modern systems.",
      "secure": false
    },
    {
      "port": 80,
      "name": "HTTP",
      "protocol": "TCP",
      "service": "Hypertext Transfer Protocol",
      "category": "Web",
      "description": "Port 80 is plain HTTP, the default for unencrypted web traffic. Modern sites redirect it to HTTPS on port 443, but port 80 is still used for the initial redirect and for ACME certificate checks.",
      "secure": false
    },
    {
      "port": 88,
      "name": "Kerberos",
      "protocol": "TCP/UDP",
      "service": "Kerberos authentication",
      "category": "Authentication",
      "description": "Port 88 is Kerberos, the ticket-based authentication protocol behind Active Directory logins. Clients contact the Key Distribution Center here to obtain and present tickets.",
      "secure": false
    },
    {
      "port": 109,
      "name": "POP2",
      "protocol": "TCP",
      "service": "Post Office Protocol v2",
      "category": "Email",
      "description": "Port 109 is POP2, an early version of the Post Office Protocol for downloading mail. It was superseded by POP3 on port 110 decades ago and is essentially unused today.",
      "secure": false
    },
    {
      "port": 110,
      "name": "POP3",
      "protocol": "TCP",
      "service": "Post Office Protocol v3",
      "category": "Email",
      "description": "Port 110 is POP3, which downloads mail from a server to a single device and usually removes it from the server. The encrypted variant, POP3S, uses port 995.",
      "secure": false
    },
    {
      "port": 111,
      "name": "RPCbind",
      "protocol": "TCP/UDP",
      "service": "ONC RPC / rpcbind (portmapper)",
      "category": "Core services",
      "description": "Port 111 is rpcbind, formerly called portmapper, which tells clients which port an ONC RPC service such as NFS is actually listening on. It has no authentication of its own, so it should never face the open internet.",
      "secure": false
    },
    {
      "port": 113,
      "name": "Ident",
      "protocol": "TCP",
      "service": "Identification Protocol",
      "category": "Legacy protocols",
      "description": "Port 113 is the Ident protocol, which some servers, notably IRC networks and older mail servers, query to associate a TCP connection with a username. Most home networks and firewalls can safely reject it.",
      "secure": false
    },
    {
      "port": 115,
      "name": "SFTP (legacy)",
      "protocol": "TCP",
      "service": "Simple File Transfer Protocol",
      "category": "File transfer",
      "description": "Port 115 is the Simple File Transfer Protocol, a simplified, rarely used file transfer scheme from the early internet. It is unrelated to the SFTP most people mean today, which is SSH File Transfer Protocol running over port 22.",
      "secure": false
    },
    {
      "port": 119,
      "name": "NNTP",
      "protocol": "TCP",
      "service": "Network News Transfer Protocol",
      "category": "Legacy protocols",
      "description": "Port 119 is NNTP, the Network News Transfer Protocol used to post and read Usenet newsgroup articles. The encrypted version, NNTPS, uses port 563.",
      "secure": false
    },
    {
      "port": 123,
      "name": "NTP",
      "protocol": "UDP",
      "service": "Network Time Protocol",
      "category": "Core services",
      "description": "Port 123 is NTP, which keeps clocks in sync across a network. Accurate time matters for logs, certificates, and Kerberos, so NTP is a quiet but critical service.",
      "secure": false
    },
    {
      "port": 135,
      "name": "MS-RPC",
      "protocol": "TCP",
      "service": "Microsoft RPC endpoint mapper",
      "category": "Windows",
      "description": "Port 135 is the Microsoft RPC endpoint mapper. Windows services use it to negotiate dynamic ports, which is why it is a frequent firewall and hardening target.",
      "secure": false
    },
    {
      "port": 137,
      "name": "NetBIOS-NS",
      "protocol": "UDP",
      "service": "NetBIOS Name Service",
      "category": "Windows",
      "description": "Port 137 is the NetBIOS Name Service, the legacy Windows name resolution that predates DNS on the LAN. It is commonly blocked at the perimeter for security.",
      "secure": false
    },
    {
      "port": 138,
      "name": "NetBIOS-DGM",
      "protocol": "UDP",
      "service": "NetBIOS Datagram Service",
      "category": "Windows",
      "description": "Port 138 is the NetBIOS Datagram Service, used for connectionless communication such as browsing the network neighborhood on older Windows systems. It is part of the same legacy NetBIOS stack as ports 137 and 139.",
      "secure": false
    },
    {
      "port": 139,
      "name": "NetBIOS-SSN",
      "protocol": "TCP",
      "service": "NetBIOS Session Service",
      "category": "Windows",
      "description": "Port 139 is the NetBIOS Session Service, used by older Windows file sharing. Modern SMB uses port 445 directly, and port 139 is often disabled.",
      "secure": false
    },
    {
      "port": 143,
      "name": "IMAP",
      "protocol": "TCP",
      "service": "Internet Message Access Protocol",
      "category": "Email",
      "description": "Port 143 is IMAP, which keeps mail on the server and syncs it across devices. The encrypted variant, IMAPS, uses port 993 and is what most clients use today.",
      "secure": false
    },
    {
      "port": 161,
      "name": "SNMP",
      "protocol": "UDP",
      "service": "Simple Network Management Protocol",
      "category": "Management",
      "description": "Port 161 is SNMP, used to poll switches, routers, and servers for health and traffic stats. Devices send unsolicited alerts (traps) from port 162.",
      "secure": false
    },
    {
      "port": 162,
      "name": "SNMP-TRAP",
      "protocol": "UDP",
      "service": "SNMP trap receiver",
      "category": "Management",
      "description": "Port 162 receives SNMP traps, the alerts a device sends when something changes, such as a link going down. A monitoring system listens here to react in real time.",
      "secure": false
    },
    {
      "port": 179,
      "name": "BGP",
      "protocol": "TCP",
      "service": "Border Gateway Protocol",
      "category": "Routing",
      "description": "Port 179 is BGP, the Border Gateway Protocol that exchanges routing information between the autonomous systems that make up the internet. It is the protocol that decides how traffic actually gets from one network to another.",
      "secure": false
    },
    {
      "port": 194,
      "name": "IRC",
      "protocol": "TCP",
      "service": "Internet Relay Chat",
      "category": "Chat & messaging",
      "description": "Port 194 is the original IANA-registered port for IRC, Internet Relay Chat. In practice almost every IRC network instead listens on port 6667 and its encrypted neighbors, leaving port 194 rarely used.",
      "secure": false
    },
    {
      "port": 389,
      "name": "LDAP",
      "protocol": "TCP/UDP",
      "service": "Lightweight Directory Access Protocol",
      "category": "Authentication",
      "description": "Port 389 is LDAP, used to query directories like Active Directory and OpenLDAP for users and groups. The encrypted form, LDAPS, uses port 636.",
      "secure": false
    },
    {
      "port": 427,
      "name": "SLP",
      "protocol": "TCP/UDP",
      "service": "Service Location Protocol",
      "category": "Routing",
      "description": "Port 427 is the Service Location Protocol, which lets devices on a local network discover services such as printers without pre-configuration. It shows up in enterprise and VMware environments and is best kept off the internet.",
      "secure": false
    },
    {
      "port": 443,
      "name": "HTTPS",
      "protocol": "TCP",
      "service": "HTTP over TLS",
      "category": "Web",
      "description": "Port 443 is HTTPS, encrypted web traffic secured by TLS. It is the default for essentially all modern websites and APIs, and increasingly carries HTTP/2 and HTTP/3 (over QUIC/UDP).",
      "secure": true
    },
    {
      "port": 445,
      "name": "SMB",
      "protocol": "TCP",
      "service": "SMB / CIFS file sharing",
      "category": "Windows",
      "description": "Port 445 is modern SMB, the protocol behind Windows file and printer sharing. It is powerful and heavily targeted, so it should never be exposed to the internet.",
      "secure": false
    },
    {
      "port": 464,
      "name": "kpasswd",
      "protocol": "TCP/UDP",
      "service": "Kerberos password change",
      "category": "Authentication",
      "description": "Port 464 is used to change a Kerberos password, separate from the authentication traffic on port 88. A Kerberos client contacts this port on the Key Distribution Center whenever a user updates their password.",
      "secure": false
    },
    {
      "port": 465,
      "name": "SMTPS",
      "protocol": "TCP",
      "service": "SMTP submission over TLS",
      "category": "Email",
      "description": "Port 465 is SMTP submission wrapped in TLS from the start (implicit TLS). Mail clients use it, or port 587, to send outgoing mail securely to a provider.",
      "secure": true
    },
    {
      "port": 500,
      "name": "ISAKMP/IKE",
      "protocol": "UDP",
      "service": "Internet Key Exchange (IPsec)",
      "category": "Routing",
      "description": "Port 500 is used by IKE, the Internet Key Exchange protocol that negotiates and manages the security keys for an IPsec VPN tunnel. NAT traversal for the same negotiation falls back to port 4500.",
      "secure": false
    },
    {
      "port": 502,
      "name": "Modbus",
      "protocol": "TCP",
      "service": "Modbus Protocol",
      "category": "IoT & automation",
      "description": "Port 502 is Modbus, a simple industrial protocol from the 1970s that is still the most common way PLCs and other factory-floor equipment talk to each other. It has no built-in security, which is a well-known concern in operational technology networks.",
      "secure": false
    },
    {
      "port": 512,
      "name": "Rexec",
      "protocol": "TCP",
      "service": "Remote Process Execution",
      "category": "Remote access",
      "description": "Port 512 is rexec, a legacy protocol for running a command on a remote host that sends the username and password in clear text. It has been replaced by SSH on port 22 for essentially every modern use case.",
      "secure": false
    },
    {
      "port": 513,
      "name": "rlogin",
      "protocol": "TCP",
      "service": "Remote login",
      "category": "Remote access",
      "description": "Port 513 is rlogin, an old remote-login protocol from the Berkeley r-commands suite that offers no encryption. SSH on port 22 replaced it because rlogin trusted the client's claimed identity far too easily.",
      "secure": false
    },
    {
      "port": 514,
      "name": "Syslog",
      "protocol": "UDP",
      "service": "Syslog logging",
      "category": "Management",
      "description": "Port 514 is syslog, the classic way network devices and servers ship log messages to a central collector. Plain syslog is unencrypted UDP, so secure deployments tunnel it.",
      "secure": false
    },
    {
      "port": 515,
      "name": "LPD",
      "protocol": "TCP",
      "service": "Line Printer Daemon",
      "category": "Printing",
      "description": "Port 515 is the Line Printer Daemon protocol, the classic Unix printing system that queues and forwards print jobs to a printer or print server. It has mostly been replaced by IPP on port 631, but many printers still accept LPD for compatibility.",
      "secure": false
    },
    {
      "port": 517,
      "name": "Talk",
      "protocol": "UDP",
      "service": "Talk protocol",
      "category": "Legacy protocols",
      "description": "Port 517 is the Talk protocol, a Unix utility that let two users chat in real time in a split-screen text window. It has been replaced by modern messaging tools and is rarely run today.",
      "secure": false
    },
    {
      "port": 518,
      "name": "ntalk",
      "protocol": "UDP",
      "service": "ntalk (Talk protocol, new version)",
      "category": "Legacy protocols",
      "description": "Port 518 is ntalk, the updated version of the Talk protocol for real-time text chat between Unix users. Like the original Talk on port 517, it has fallen out of use.",
      "secure": false
    },
    {
      "port": 520,
      "name": "RIP",
      "protocol": "UDP",
      "service": "Routing Information Protocol",
      "category": "Routing",
      "description": "Port 520 is RIP, the Routing Information Protocol, one of the oldest ways routers share network reachability information. It has largely been replaced by more capable protocols like OSPF and BGP but still appears in small or legacy networks.",
      "secure": false
    },
    {
      "port": 554,
      "name": "RTSP",
      "protocol": "TCP/UDP",
      "service": "Real Time Streaming Protocol",
      "category": "VoIP & streaming",
      "description": "Port 554 is RTSP, the Real Time Streaming Protocol used to control playback of streaming media, most commonly IP security cameras. RTSP sets up and controls the session while the actual audio and video usually flow over RTP on separate ports.",
      "secure": false
    },
    {
      "port": 587,
      "name": "Submission",
      "protocol": "TCP",
      "service": "SMTP mail submission (STARTTLS)",
      "category": "Email",
      "description": "Port 587 is the standard mail submission port for clients sending outgoing mail. It upgrades to TLS with STARTTLS and requires authentication, which is why providers prefer it over port 25.",
      "secure": true
    },
    {
      "port": 631,
      "name": "IPP",
      "protocol": "TCP/UDP",
      "service": "Internet Printing Protocol",
      "category": "Printing",
      "description": "Port 631 is the Internet Printing Protocol, the modern standard for sending print jobs and querying printer status over the network. CUPS, the print system used by Linux and macOS, runs its web interface and printing service on this port.",
      "secure": false
    },
    {
      "port": 636,
      "name": "LDAPS",
      "protocol": "TCP",
      "service": "LDAP over TLS",
      "category": "Authentication",
      "description": "Port 636 is LDAPS, LDAP directory queries encrypted with TLS. It protects credentials and directory data in transit, unlike plain LDAP on port 389.",
      "secure": true
    },
    {
      "port": 646,
      "name": "LDP",
      "protocol": "TCP",
      "service": "Label Distribution Protocol",
      "category": "Routing",
      "description": "Port 646 is LDP, the Label Distribution Protocol that MPLS routers use to agree on the labels that steer traffic through a label-switched path. It is a core building block of carrier and large enterprise MPLS networks.",
      "secure": false
    },
    {
      "port": 749,
      "name": "kerberos-adm",
      "protocol": "TCP",
      "service": "Kerberos administration",
      "category": "Authentication",
      "description": "Port 749 is the Kerberos administration port, used by admin tools to manage principals and policies on the Key Distribution Center. It is a privileged management channel and should be limited to admin hosts.",
      "secure": false
    },
    {
      "port": 853,
      "name": "DNS over TLS",
      "protocol": "TCP",
      "service": "DNS over TLS (DoT)",
      "category": "Core services",
      "description": "Port 853 is DNS over TLS, which encrypts DNS queries between a client and resolver to stop eavesdropping and tampering on the network path. It is the dedicated-port alternative to DNS over HTTPS, which instead shares port 443.",
      "secure": true
    },
    {
      "port": 873,
      "name": "rsync",
      "protocol": "TCP",
      "service": "rsync file synchronization",
      "category": "File transfer",
      "description": "Port 873 is rsync, used by the rsync daemon to synchronize files and directories efficiently by transferring only the parts of a file that changed. Most rsync usage today tunnels over SSH on port 22 instead, but the standalone daemon still listens here.",
      "secure": false
    },
    {
      "port": 989,
      "name": "FTPS-DATA",
      "protocol": "TCP",
      "service": "FTPS Protocol (data)",
      "category": "File transfer",
      "description": "Port 989 is the data channel for FTPS, FTP secured with implicit TLS. It pairs with the control channel on port 990 to transfer files with encryption applied from the moment the connection opens.",
      "secure": true
    },
    {
      "port": 990,
      "name": "FTPS",
      "protocol": "TCP",
      "service": "FTPS Protocol (control)",
      "category": "File transfer",
      "description": "Port 990 is the control channel for FTPS, FTP wrapped in implicit TLS. It negotiates the encrypted session before file data moves over port 989, unlike plain FTP on ports 20 and 21.",
      "secure": true
    },
    {
      "port": 993,
      "name": "IMAPS",
      "protocol": "TCP",
      "service": "IMAP over TLS",
      "category": "Email",
      "description": "Port 993 is IMAPS, encrypted IMAP mail access. Almost every mail client uses port 993 rather than plain IMAP on port 143.",
      "secure": true
    },
    {
      "port": 995,
      "name": "POP3S",
      "protocol": "TCP",
      "service": "POP3 over TLS",
      "category": "Email",
      "description": "Port 995 is POP3S, encrypted POP3 mail download. It secures the login and message transfer that plain POP3 on port 110 leaves exposed.",
      "secure": true
    },
    {
      "port": 1080,
      "name": "SOCKS",
      "protocol": "TCP",
      "service": "SOCKS proxy",
      "category": "Proxy & tunneling",
      "description": "Port 1080 is the default port for a SOCKS proxy, which relays arbitrary TCP, and in SOCKS5 also UDP, traffic on behalf of a client without understanding the application protocol inside it. SSH's built-in dynamic port forwarding (ssh -D) creates a SOCKS proxy on a port like this one.",
      "secure": false
    },
    {
      "port": 1194,
      "name": "OpenVPN",
      "protocol": "TCP/UDP",
      "service": "OpenVPN",
      "category": "Remote access",
      "description": "Port 1194 is the default port for OpenVPN, a widely used open-source VPN protocol. It runs over UDP by default for performance, though OpenVPN can also fall back to TCP on the same port to get through restrictive firewalls.",
      "secure": false
    },
    {
      "port": 1433,
      "name": "MSSQL",
      "protocol": "TCP",
      "service": "Microsoft SQL Server",
      "category": "Databases",
      "description": "Port 1433 is the default listener for Microsoft SQL Server. Like all database ports, it should be reachable only from application servers, never from the open internet.",
      "secure": false
    },
    {
      "port": 1434,
      "name": "MSSQL Browser",
      "protocol": "UDP",
      "service": "Microsoft SQL Server Browser service",
      "category": "Databases",
      "description": "Port 1434 is the SQL Server Browser service, which listens for UDP requests and reports back which dynamic TCP port a named SQL Server instance is actually using. It exists because named instances do not use the fixed port 1433.",
      "secure": false
    },
    {
      "port": 1512,
      "name": "WINS",
      "protocol": "TCP/UDP",
      "service": "Windows Internet Name Service",
      "category": "Windows",
      "description": "Port 1512 is WINS, the Windows Internet Name Service that resolves NetBIOS computer names to IP addresses across routed networks. Microsoft has deprecated it in favor of DNS, but it still appears in some legacy Active Directory environments.",
      "secure": false
    },
    {
      "port": 1521,
      "name": "Oracle",
      "protocol": "TCP",
      "service": "Oracle database listener",
      "category": "Databases",
      "description": "Port 1521 is the Oracle database listener, where clients connect to an Oracle instance. It is a common target, so restrict it to trusted application hosts.",
      "secure": false
    },
    {
      "port": 1701,
      "name": "L2TP",
      "protocol": "UDP",
      "service": "Layer 2 Tunneling Protocol",
      "category": "Remote access",
      "description": "Port 1701 is L2TP, the Layer 2 Tunneling Protocol used to create VPN tunnels. L2TP has no encryption of its own, so it is almost always paired with IPsec, which negotiates over ports 500 and 4500.",
      "secure": false
    },
    {
      "port": 1723,
      "name": "PPTP",
      "protocol": "TCP",
      "service": "Point-to-Point Tunneling Protocol",
      "category": "Remote access",
      "description": "Port 1723 is PPTP, an early Microsoft VPN protocol. Its encryption has been broken for years, so it should not be used where real security matters; modern deployments use OpenVPN, WireGuard, or IPsec instead.",
      "secure": false
    },
    {
      "port": 1812,
      "name": "RADIUS",
      "protocol": "UDP",
      "service": "RADIUS authentication",
      "category": "Authentication",
      "description": "Port 1812 is RADIUS authentication, the protocol Wi-Fi networks, VPNs, and network switches use to check a username and password against a central server. RADIUS accounting, which logs session activity, uses port 1813.",
      "secure": false
    },
    {
      "port": 1813,
      "name": "RADIUS accounting",
      "protocol": "UDP",
      "service": "RADIUS accounting",
      "category": "Authentication",
      "description": "Port 1813 is RADIUS accounting, which logs session start, stop, and usage data after RADIUS authentication on port 1812 succeeds. ISPs and enterprise networks use it to track connection time and data usage.",
      "secure": false
    },
    {
      "port": 1883,
      "name": "MQTT",
      "protocol": "TCP",
      "service": "MQTT publish-subscribe messaging",
      "category": "IoT & automation",
      "description": "Port 1883 is MQTT, a lightweight publish-subscribe messaging protocol built for IoT devices with limited bandwidth or power. A device publishes to a topic and a broker fans the message out to every subscriber, without sender and receiver needing to connect directly.",
      "secure": false
    },
    {
      "port": 1900,
      "name": "SSDP",
      "protocol": "UDP",
      "service": "Simple Service Discovery Protocol",
      "category": "Chat & messaging",
      "description": "Port 1900 is SSDP, the discovery protocol behind UPnP that lets devices like smart TVs, printers, and media servers announce themselves and find each other on the local network. It is not meant to be reachable from outside the LAN.",
      "secure": false
    },
    {
      "port": 1935,
      "name": "RTMP",
      "protocol": "TCP",
      "service": "Real-Time Messaging Protocol",
      "category": "VoIP & streaming",
      "description": "Port 1935 is RTMP, the Real-Time Messaging Protocol originally built for Flash media streaming. It is still the standard port for pushing a live stream from broadcasting software into services like YouTube and Twitch before they transcode it for viewers.",
      "secure": false
    },
    {
      "port": 2000,
      "name": "SCCP",
      "protocol": "TCP",
      "service": "Cisco Skinny Client Control Protocol",
      "category": "VoIP & streaming",
      "description": "Port 2000 is SCCP, Cisco's Skinny Client Control Protocol used by Cisco IP phones to talk to a Cisco Unified Communications Manager. It is a lightweight alternative to SIP within Cisco VoIP deployments.",
      "secure": false
    },
    {
      "port": 2049,
      "name": "NFS",
      "protocol": "TCP/UDP",
      "service": "Network File System",
      "category": "Core services",
      "description": "Port 2049 is NFS, the Network File System that lets Unix and Linux hosts mount a remote directory as if it were local. NFS traffic is unauthenticated by default, so it is normally restricted to trusted internal networks.",
      "secure": false
    },
    {
      "port": 2181,
      "name": "ZooKeeper",
      "protocol": "TCP",
      "service": "Apache ZooKeeper client port",
      "category": "Infrastructure & orchestration",
      "description": "Port 2181 is the client port for Apache ZooKeeper, a coordination service that older Kafka clusters and other distributed systems use to elect leaders and store configuration. Newer Kafka versions can run without ZooKeeper, but it remains common in existing deployments.",
      "secure": false
    },
    {
      "port": 2222,
      "name": "EtherNet/IP",
      "protocol": "TCP/UDP",
      "service": "EtherNet/IP implicit messaging",
      "category": "IoT & automation",
      "description": "Port 2222 is officially registered for EtherNet/IP implicit messaging, an industrial automation protocol built on standard Ethernet. The same number is also a popular unofficial convention for an alternate SSH port on servers that want to avoid the noise on port 22.",
      "secure": false
    },
    {
      "port": 2375,
      "name": "Docker",
      "protocol": "TCP",
      "service": "Docker daemon API (unencrypted)",
      "category": "Infrastructure & orchestration",
      "description": "Port 2375 is the Docker Engine API without TLS, giving whoever can reach it full control over every container on the host, equivalent to root access. It should only ever be bound to localhost or a trusted internal network.",
      "secure": false
    },
    {
      "port": 2376,
      "name": "Docker TLS",
      "protocol": "TCP",
      "service": "Docker daemon API (TLS)",
      "category": "Infrastructure & orchestration",
      "description": "Port 2376 is the Docker Engine API secured with TLS client certificates, the safer counterpart to the unencrypted API on port 2375. It is the port Docker's own documentation recommends when the API needs to be reachable remotely.",
      "secure": true
    },
    {
      "port": 2379,
      "name": "etcd",
      "protocol": "TCP",
      "service": "etcd client API",
      "category": "Infrastructure & orchestration",
      "description": "Port 2379 is the client port for etcd, the distributed key-value store that Kubernetes uses to store all of its cluster state. Anyone who can read from etcd can effectively read every Kubernetes secret, so this port needs strict access control.",
      "secure": false
    },
    {
      "port": 2380,
      "name": "etcd peer",
      "protocol": "TCP",
      "service": "etcd peer communication",
      "category": "Infrastructure & orchestration",
      "description": "Port 2380 is used for peer-to-peer traffic between etcd nodes in a cluster, keeping their replicated data in sync via the Raft consensus protocol. It is separate from the client-facing port 2379.",
      "secure": false
    },
    {
      "port": 2401,
      "name": "CVS pserver",
      "protocol": "TCP",
      "service": "CVS pserver",
      "category": "Version control",
      "description": "Port 2401 is CVS pserver, the password-authenticated server mode for the CVS version control system. CVS has largely been replaced by Subversion and Git, but the port is still occasionally seen on legacy infrastructure.",
      "secure": false
    },
    {
      "port": 3000,
      "name": "Dev server",
      "protocol": "TCP",
      "service": "Common development server port (Node.js, Rails, React)",
      "category": "Web",
      "description": "Port 3000 is not IANA-assigned to any single service, but by convention it is the default for many local development servers, including Node.js frameworks like Express, Ruby on Rails, and Create React App. Seeing it in a URL almost always means you are looking at an app still in development.",
      "secure": false
    },
    {
      "port": 3050,
      "name": "Firebird",
      "protocol": "TCP",
      "service": "Firebird database (gds_db)",
      "category": "Databases",
      "description": "Port 3050 is the Firebird database server's default listener, registered with IANA under the name gds_db. Firebird is an open-source relational database descended from Borland InterBase.",
      "secure": false
    },
    {
      "port": 3074,
      "name": "Xbox Live",
      "protocol": "TCP/UDP",
      "service": "Xbox Live / multiplayer",
      "category": "Gaming",
      "description": "Port 3074 is used by Xbox Live for multiplayer matchmaking and voice chat. Console players who have trouble joining games are often told to forward this port, since strict NAT settings frequently block it.",
      "secure": false
    },
    {
      "port": 3128,
      "name": "Squid",
      "protocol": "TCP",
      "service": "Squid caching proxy",
      "category": "Proxy & tunneling",
      "description": "Port 3128 is the traditional default port for the Squid caching proxy, widely used to filter, cache, and log outbound web traffic for a network. It is a long-standing convention rather than an IANA assignment.",
      "secure": false
    },
    {
      "port": 3268,
      "name": "Global Catalog",
      "protocol": "TCP",
      "service": "Microsoft Active Directory Global Catalog",
      "category": "Windows",
      "description": "Port 3268 is the Active Directory Global Catalog port, which lets applications search for objects across every domain in a forest instead of just one domain. It carries the same LDAP protocol as port 389, scoped to the forest-wide catalog.",
      "secure": false
    },
    {
      "port": 3269,
      "name": "Global Catalog SSL",
      "protocol": "TCP",
      "service": "Global Catalog over SSL/TLS",
      "category": "Windows",
      "description": "Port 3269 is the Global Catalog port encrypted with TLS, the secure counterpart to port 3268. Applications use it to query Active Directory objects across an entire forest without sending the query in clear text.",
      "secure": true
    },
    {
      "port": 3283,
      "name": "Apple Remote Desktop",
      "protocol": "UDP",
      "service": "Apple Remote Desktop (Net Assistant)",
      "category": "Remote access",
      "description": "Port 3283 is used by Apple Remote Desktop's Net Assistant reporting feature to collect status information from managed Macs. Screen sharing itself typically rides over VNC on port 5900.",
      "secure": false
    },
    {
      "port": 3306,
      "name": "MySQL",
      "protocol": "TCP",
      "service": "MySQL / MariaDB",
      "category": "Databases",
      "description": "Port 3306 is the default for MySQL and MariaDB. Keep it bound to localhost or an internal network; exposing it invites brute-force and injection attempts.",
      "secure": false
    },
    {
      "port": 3389,
      "name": "RDP",
      "protocol": "TCP",
      "service": "Remote Desktop Protocol",
      "category": "Remote access",
      "description": "Port 3389 is RDP, Windows Remote Desktop. It is one of the most-attacked ports on the internet, so put it behind a VPN or gateway rather than exposing it directly.",
      "secure": false
    },
    {
      "port": 3478,
      "name": "STUN/TURN",
      "protocol": "TCP/UDP",
      "service": "STUN/TURN (NAT traversal for WebRTC)",
      "category": "Proxy & tunneling",
      "description": "Port 3478 is STUN and TURN, the protocols that help two devices behind NAT establish a direct connection for real-time voice, video, or WebRTC data. When a direct connection cannot be made, a TURN server on this port relays the media instead.",
      "secure": false
    },
    {
      "port": 3689,
      "name": "DAAP",
      "protocol": "TCP",
      "service": "Digital Audio Access Protocol",
      "category": "VoIP & streaming",
      "description": "Port 3689 is DAAP, the Digital Audio Access Protocol that iTunes and compatible apps use to share a music library over a local network. It is the protocol behind classic iTunes home sharing.",
      "secure": false
    },
    {
      "port": 3690,
      "name": "Subversion",
      "protocol": "TCP",
      "service": "Subversion (svn) protocol",
      "category": "Version control",
      "description": "Port 3690 is the native svn protocol port for Subversion, used when a repository is accessed with an svn:// URL instead of over HTTP. It talks to the svnserve daemon directly.",
      "secure": false
    },
    {
      "port": 4444,
      "name": "krb524",
      "protocol": "TCP",
      "service": "Kerberos 5 to 4 ticket translator",
      "category": "Proxy & tunneling",
      "description": "Port 4444 is officially registered for krb524, a legacy service that translated Kerberos 5 tickets into the older Kerberos 4 format. In practice the number is far better known today as a common default listener port in penetration-testing tools, which is worth knowing if you spot unexpected traffic on it.",
      "secure": false
    },
    {
      "port": 4500,
      "name": "IPsec NAT-T",
      "protocol": "UDP",
      "service": "IPsec NAT Traversal",
      "category": "Routing",
      "description": "Port 4500 carries IPsec traffic once IKE on port 500 detects that a NAT device sits between the two VPN endpoints. Wrapping the IPsec packets in UDP on this port lets them pass through routers that would otherwise break the tunnel.",
      "secure": false
    },
    {
      "port": 5060,
      "name": "SIP",
      "protocol": "TCP/UDP",
      "service": "Session Initiation Protocol",
      "category": "VoIP & streaming",
      "description": "Port 5060 is SIP, the Session Initiation Protocol that sets up, modifies, and tears down VoIP calls and video sessions. The actual audio and video then typically flow over RTP on a separate, dynamically negotiated port range.",
      "secure": false
    },
    {
      "port": 5061,
      "name": "SIP-TLS",
      "protocol": "TCP",
      "service": "SIP over TLS",
      "category": "VoIP & streaming",
      "description": "Port 5061 is SIP encrypted with TLS, protecting call setup signaling, such as who is calling whom, from eavesdropping. It is the secure counterpart to plain SIP on port 5060.",
      "secure": true
    },
    {
      "port": 5222,
      "name": "XMPP",
      "protocol": "TCP",
      "service": "XMPP client connection",
      "category": "Chat & messaging",
      "description": "Port 5222 is where XMPP clients, such as Jabber-based chat apps, connect to their server. XMPP is the open messaging protocol behind many federated chat systems and some IoT messaging setups.",
      "secure": false
    },
    {
      "port": 5269,
      "name": "XMPP server",
      "protocol": "TCP",
      "service": "XMPP server-to-server",
      "category": "Chat & messaging",
      "description": "Port 5269 is used for server-to-server XMPP federation, letting users on one XMPP server message users on a different server, similar to how email servers relay mail between domains.",
      "secure": false
    },
    {
      "port": 5349,
      "name": "TURN-TLS",
      "protocol": "TCP",
      "service": "STUN/TURN over TLS",
      "category": "Proxy & tunneling",
      "description": "Port 5349 is STUN and TURN encrypted with TLS, used by WebRTC applications on networks that block plain UDP traffic. Wrapping the connection in TLS lets it travel over the same paths as ordinary encrypted web traffic.",
      "secure": true
    },
    {
      "port": 5353,
      "name": "mDNS",
      "protocol": "UDP",
      "service": "Multicast DNS",
      "category": "Core services",
      "description": "Port 5353 is Multicast DNS, used by protocols like Apple's Bonjour and various IoT devices to resolve hostnames on the local network without a DNS server. It only works within a single broadcast domain.",
      "secure": false
    },
    {
      "port": 5432,
      "name": "PostgreSQL",
      "protocol": "TCP",
      "service": "PostgreSQL database",
      "category": "Databases",
      "description": "Port 5432 is the default PostgreSQL listener. As with any database, limit it to application servers and require TLS and strong credentials.",
      "secure": false
    },
    {
      "port": 5672,
      "name": "AMQP",
      "protocol": "TCP",
      "service": "Advanced Message Queuing Protocol",
      "category": "Message queues",
      "description": "Port 5672 is AMQP, the Advanced Message Queuing Protocol most commonly associated with RabbitMQ. Applications publish messages to queues and exchanges on this port so that other services can consume them asynchronously.",
      "secure": false
    },
    {
      "port": 5683,
      "name": "CoAP",
      "protocol": "UDP",
      "service": "Constrained Application Protocol",
      "category": "IoT & automation",
      "description": "Port 5683 is CoAP, the Constrained Application Protocol designed for small, low-power IoT devices that cannot afford the overhead of full HTTP. It mirrors HTTP's request and response model but runs over UDP with a much lighter binary format.",
      "secure": false
    },
    {
      "port": 5900,
      "name": "VNC",
      "protocol": "TCP",
      "service": "Virtual Network Computing",
      "category": "Remote access",
      "description": "Port 5900 is VNC, a cross-platform remote desktop protocol. Base VNC is unencrypted, so tunnel it over SSH or a VPN rather than exposing it directly.",
      "secure": false
    },
    {
      "port": 5984,
      "name": "CouchDB",
      "protocol": "TCP",
      "service": "Apache CouchDB HTTP API",
      "category": "Databases",
      "description": "Port 5984 is the default HTTP API port for Apache CouchDB, a document database that you query and update using plain HTTP requests and JSON. It is a project default rather than an IANA-registered port.",
      "secure": false
    },
    {
      "port": 5985,
      "name": "WinRM",
      "protocol": "TCP",
      "service": "Windows Remote Management (HTTP)",
      "category": "Remote access",
      "description": "Port 5985 is WinRM over HTTP, used to remotely run PowerShell commands and manage Windows machines. Because the traffic is unencrypted on this port, production environments should use the TLS version on port 5986 instead.",
      "secure": false
    },
    {
      "port": 5986,
      "name": "WinRM HTTPS",
      "protocol": "TCP",
      "service": "Windows Remote Management (HTTPS)",
      "category": "Remote access",
      "description": "Port 5986 is WinRM over HTTPS, the encrypted channel for remote PowerShell sessions and Windows management tooling such as Ansible's WinRM connector. It is the port to use instead of plain WinRM on port 5985.",
      "secure": true
    },
    {
      "port": 6379,
      "name": "Redis",
      "protocol": "TCP",
      "service": "Redis key-value store",
      "category": "Databases",
      "description": "Port 6379 is Redis, an in-memory data store. Older Redis had no auth by default, so an exposed port 6379 is a classic breach vector; bind it to localhost.",
      "secure": false
    },
    {
      "port": 6443,
      "name": "Kubernetes API",
      "protocol": "TCP",
      "service": "Kubernetes API server",
      "category": "Infrastructure & orchestration",
      "description": "Port 6443 is the default port for the Kubernetes API server, the control-plane endpoint that kubectl and every cluster component talk to. Access to it is effectively access to the whole cluster, so it is normally protected with strong authentication and network policy.",
      "secure": false
    },
    {
      "port": 6514,
      "name": "Syslog-TLS",
      "protocol": "TCP",
      "service": "Syslog over TLS",
      "category": "Management",
      "description": "Port 6514 is syslog over TLS, the encrypted version of the plain UDP syslog on port 514. It protects log data in transit, which matters because syslog messages often include sensitive details about system events.",
      "secure": true
    },
    {
      "port": 6600,
      "name": "MPD",
      "protocol": "TCP",
      "service": "Music Player Daemon",
      "category": "VoIP & streaming",
      "description": "Port 6600 is the default port for the Music Player Daemon, a server that plays audio files and lets separate client apps control playback remotely. It is a project convention, not an IANA-registered port.",
      "secure": false
    },
    {
      "port": 6667,
      "name": "IRC (de facto)",
      "protocol": "TCP",
      "service": "Internet Relay Chat",
      "category": "Chat & messaging",
      "description": "Port 6667 is the de facto standard port for IRC, Internet Relay Chat, even though 194 is the officially registered one. Most public IRC networks also offer an encrypted option on port 6697.",
      "secure": false
    },
    {
      "port": 6881,
      "name": "BitTorrent",
      "protocol": "TCP/UDP",
      "service": "BitTorrent peer-to-peer file sharing",
      "category": "File transfer",
      "description": "Port 6881 is the first port in the range from 6881 to 6999 that BitTorrent clients traditionally listen on for incoming peer connections. Most modern clients also negotiate other ports via UPnP, but 6881 remains the conventional default.",
      "secure": false
    },
    {
      "port": 8000,
      "name": "HTTP-alt",
      "protocol": "TCP",
      "service": "Alternate HTTP / common dev server",
      "category": "Web",
      "description": "Port 8000 has no fixed IANA assignment, but it is a popular convention for local web servers, including Python's built-in http.server and Django's runserver command. It sits alongside 8080 and 3000 as one of the go-to alternate HTTP ports for development.",
      "secure": false
    },
    {
      "port": 8008,
      "name": "HTTP-alt",
      "protocol": "TCP",
      "service": "Alternate HTTP / Google Cast discovery",
      "category": "Web",
      "description": "Port 8008 is commonly used as an alternate, unprivileged HTTP port, and it is also the port Chromecast and other Google Cast devices use for local discovery and control over the DIAL protocol. It is not a fixed IANA assignment, just a widely followed convention.",
      "secure": false
    },
    {
      "port": 8080,
      "name": "HTTP-alt",
      "protocol": "TCP",
      "service": "Alternate HTTP / proxy",
      "category": "Web",
      "description": "Port 8080 is a common alternate HTTP port, used by dev servers, proxies, and app servers like Tomcat. It carries the same protocol as port 80 without needing root to bind.",
      "secure": false
    },
    {
      "port": 8081,
      "name": "HTTP-alt",
      "protocol": "TCP",
      "service": "Alternate HTTP / proxy",
      "category": "Web",
      "description": "Port 8081 is a common secondary alternate HTTP port, often used to run a second web service or proxy alongside something already listening on port 8080. Like 8080, it needs no root privileges to bind.",
      "secure": false
    },
    {
      "port": 8086,
      "name": "InfluxDB",
      "protocol": "TCP",
      "service": "InfluxDB HTTP API",
      "category": "Databases",
      "description": "Port 8086 is the default HTTP API port for InfluxDB, a time-series database commonly used for metrics and monitoring data. Writes and queries both go through this single HTTP endpoint.",
      "secure": false
    },
    {
      "port": 8096,
      "name": "Jellyfin",
      "protocol": "TCP",
      "service": "Jellyfin / Emby media server",
      "category": "VoIP & streaming",
      "description": "Port 8096 is the default HTTP port for the Jellyfin and Emby self-hosted media server applications, used to stream your own movie and TV library. Both projects share the same default port because Jellyfin began as a fork of Emby.",
      "secure": false
    },
    {
      "port": 8200,
      "name": "Vault",
      "protocol": "TCP",
      "service": "HashiCorp Vault API",
      "category": "Infrastructure & orchestration",
      "description": "Port 8200 is the default API port for HashiCorp Vault, a tool for storing and tightly controlling access to secrets like API keys and certificates. Production Vault deployments are expected to serve this port over TLS.",
      "secure": false
    },
    {
      "port": 8384,
      "name": "Syncthing",
      "protocol": "TCP",
      "service": "Syncthing web GUI",
      "category": "File transfer",
      "description": "Port 8384 is the default web interface for Syncthing, an open-source tool that synchronizes files directly between devices without a central cloud server. It is meant to be reached only from the local machine or network, not the open internet.",
      "secure": false
    },
    {
      "port": 8443,
      "name": "HTTPS-alt",
      "protocol": "TCP",
      "service": "Alternate HTTPS",
      "category": "Web",
      "description": "Port 8443 is a common alternate HTTPS port for admin consoles and app servers. It runs TLS like port 443 but avoids the privileged sub-1024 range.",
      "secure": true
    },
    {
      "port": 8500,
      "name": "Consul",
      "protocol": "TCP",
      "service": "HashiCorp Consul HTTP API / UI",
      "category": "Infrastructure & orchestration",
      "description": "Port 8500 is the HTTP API and web UI port for HashiCorp Consul, a service discovery and health-checking tool used to keep track of what services are running where. Consul also uses separate ports for DNS and internal cluster gossip.",
      "secure": false
    },
    {
      "port": 8883,
      "name": "MQTTS",
      "protocol": "TCP",
      "service": "MQTT over TLS",
      "category": "IoT & automation",
      "description": "Port 8883 is MQTT encrypted with TLS, used when IoT devices need to authenticate to the broker and protect message contents in transit. It is the secure counterpart to plain MQTT on port 1883.",
      "secure": true
    },
    {
      "port": 9000,
      "name": "Alt-9000",
      "protocol": "TCP",
      "service": "Common alternate app port (PHP-FPM, SonarQube, Portainer)",
      "category": "Web",
      "description": "Port 9000 has no single fixed meaning; it is used by PHP-FPM's FastCGI listener, the SonarQube code-quality dashboard, the Portainer container UI, and various other tools by convention rather than IANA assignment. Always check what is actually bound to it on a given host.",
      "secure": false
    },
    {
      "port": 9042,
      "name": "Cassandra",
      "protocol": "TCP",
      "service": "Apache Cassandra native transport (CQL)",
      "category": "Databases",
      "description": "Port 9042 is the default port for Apache Cassandra's native transport, which client drivers use to send CQL queries to the cluster. Cassandra's older Thrift interface used port 9160, now largely retired.",
      "secure": false
    },
    {
      "port": 9090,
      "name": "Prometheus",
      "protocol": "TCP",
      "service": "Prometheus monitoring web UI",
      "category": "Web",
      "description": "Port 9090 is the default web interface and API port for Prometheus, the open-source metrics and monitoring system. Individual exporters that feed data into Prometheus typically run on their own ports, such as 9100 for the Node Exporter.",
      "secure": false
    },
    {
      "port": 9091,
      "name": "Transmission",
      "protocol": "TCP",
      "service": "Transmission BitTorrent client web UI",
      "category": "File transfer",
      "description": "Port 9091 is the default web interface port for the Transmission BitTorrent client, letting you add and manage torrents from a browser. It is a convention set by the Transmission project rather than an IANA assignment.",
      "secure": false
    },
    {
      "port": 9092,
      "name": "Kafka",
      "protocol": "TCP",
      "service": "Apache Kafka broker",
      "category": "Message queues",
      "description": "Port 9092 is the default port for an Apache Kafka broker, the distributed event-streaming platform used to move high volumes of data between systems in real time. Producers and consumers both connect on this port unless a cluster is configured otherwise.",
      "secure": false
    },
    {
      "port": 9100,
      "name": "JetDirect",
      "protocol": "TCP",
      "service": "Raw / HP JetDirect printing",
      "category": "Printing",
      "description": "Port 9100 is raw, or JetDirect, printing, where a print job is sent directly to a network printer without a print-spooler protocol wrapping it. It is also, coincidentally, the conventional port for the Prometheus Node Exporter, so check which service you actually mean before troubleshooting.",
      "secure": false
    },
    {
      "port": 9200,
      "name": "Elasticsearch",
      "protocol": "TCP",
      "service": "Elasticsearch HTTP / REST API",
      "category": "Databases",
      "description": "Port 9200 is the default HTTP port for Elasticsearch, where clients send search and indexing requests as JSON over REST. Nodes in a cluster also talk to each other on a separate transport port, 9300, by default.",
      "secure": false
    },
    {
      "port": 9418,
      "name": "Git",
      "protocol": "TCP",
      "service": "Git protocol",
      "category": "Version control",
      "description": "Port 9418 is the Git protocol, a fast, unauthenticated way to clone and fetch a repository that predates doing everything over SSH or HTTPS. Most hosting services today disable it in favor of SSH on port 22 or HTTPS on port 443.",
      "secure": false
    },
    {
      "port": 10050,
      "name": "Zabbix agent",
      "protocol": "TCP",
      "service": "Zabbix agent",
      "category": "Management",
      "description": "Port 10050 is the default port for the Zabbix monitoring agent, which runs on a monitored host and answers requests from the Zabbix server. It is a project convention rather than an IANA assignment.",
      "secure": false
    },
    {
      "port": 10051,
      "name": "Zabbix server",
      "protocol": "TCP",
      "service": "Zabbix server / trapper",
      "category": "Management",
      "description": "Port 10051 is the default Zabbix server port, used both for agents sending trapper items and for the server itself. It pairs with the agent port 10050 to make up the standard Zabbix monitoring stack.",
      "secure": false
    },
    {
      "port": 10250,
      "name": "Kubelet",
      "protocol": "TCP",
      "service": "Kubernetes kubelet API",
      "category": "Infrastructure & orchestration",
      "description": "Port 10250 is the kubelet API, exposed by the agent that runs on every Kubernetes node to manage the containers scheduled there. It has been the target of real-world attacks when left unauthenticated, so securing it is a standard cluster-hardening step.",
      "secure": false
    },
    {
      "port": 11211,
      "name": "Memcached",
      "protocol": "TCP/UDP",
      "service": "Memcached",
      "category": "Databases",
      "description": "Port 11211 is the default port for Memcached, an in-memory key-value cache used to speed up applications by avoiding repeated database queries. It has no authentication in its classic protocol, so it should never be reachable from the public internet.",
      "secure": false
    },
    {
      "port": 19132,
      "name": "Minecraft Bedrock",
      "protocol": "UDP",
      "service": "Minecraft Bedrock Edition server",
      "category": "Gaming",
      "description": "Port 19132 is the default port for a Minecraft Bedrock Edition server, the version of the game that runs on consoles, mobile, and Windows. Bedrock uses UDP, unlike the Java Edition server on port 25565, which uses TCP.",
      "secure": false
    },
    {
      "port": 20000,
      "name": "DNP3",
      "protocol": "TCP/UDP",
      "service": "Distributed Network Protocol 3",
      "category": "IoT & automation",
      "description": "Port 20000 is DNP3, a protocol widely used in electric and water utility SCADA systems to communicate between control centers and remote field equipment. Like many older industrial protocols, it was not designed with modern network security in mind.",
      "secure": false
    },
    {
      "port": 25565,
      "name": "Minecraft",
      "protocol": "TCP",
      "service": "Minecraft Java Edition server",
      "category": "Gaming",
      "description": "Port 25565 is the default port for a Minecraft Java Edition server. It is not an IANA-registered port, just the value Mojang's server software has shipped with by default since the game's early years, and it is one of the most-searched ports on the internet for exactly that reason.",
      "secure": false
    },
    {
      "port": 27015,
      "name": "Source engine",
      "protocol": "TCP/UDP",
      "service": "Valve Source engine game/query port",
      "category": "Gaming",
      "description": "Port 27015 is the default game and server-browser query port for games built on Valve's Source engine, including Counter-Strike and Team Fortress 2. Dedicated servers use it for both gameplay traffic and for responding to server-list queries.",
      "secure": false
    },
    {
      "port": 27017,
      "name": "MongoDB",
      "protocol": "TCP",
      "service": "MongoDB database",
      "category": "Databases",
      "description": "Port 27017 is the default MongoDB listener. Unsecured MongoDB on this port has caused many data leaks, so enable auth and keep it off the public internet.",
      "secure": false
    },
    {
      "port": 32400,
      "name": "Plex",
      "protocol": "TCP",
      "service": "Plex Media Server",
      "category": "VoIP & streaming",
      "description": "Port 32400 is the default port for Plex Media Server, the self-hosted platform for streaming your own movies, shows, and music to any device. It is a Plex convention rather than an IANA assignment.",
      "secure": false
    },
    {
      "port": 47808,
      "name": "BACnet",
      "protocol": "UDP",
      "service": "BACnet building automation",
      "category": "IoT & automation",
      "description": "Port 47808 is BACnet, the standard protocol for building automation systems that control HVAC, lighting, and access control in commercial buildings. Exposing it to the internet has led to real incidents of building systems being manipulated remotely.",
      "secure": false
    },
    {
      "port": 50000,
      "name": "IBM Db2",
      "protocol": "TCP",
      "service": "IBM Db2 database",
      "category": "Databases",
      "description": "Port 50000 is the conventional default listener port for IBM Db2 database connections. It is set by Db2's installer rather than assigned by IANA, and administrators can change it.",
      "secure": false
    },
    {
      "port": 61616,
      "name": "ActiveMQ",
      "protocol": "TCP",
      "service": "Apache ActiveMQ OpenWire",
      "category": "Message queues",
      "description": "Port 61616 is the default OpenWire port for Apache ActiveMQ, a message broker that supports several messaging protocols. It is the port most Java clients use to connect with ActiveMQ's native protocol.",
      "secure": false
    }
  ]
}