| TCP | 1024 | NetSpy.698(YAI) |
| TCP | 1025 | NetSpy.698,Unused Windows Services Block |
| TCP | 1026 | Unused Windows Services Block |
| TCP | 1027 | Unused Windows Services Block |
| TCP | 1028 | Unused Windows Services Block |
| TCP | 1029 | Unused Windows Services Block |
| TCP | 1030 | Unused Windows Services Block |
| TCP | 1033 | Netspy |
| TCP | 1035 | Multidropper |
| TCP | 1042 | Bla |
| TCP | 1045 | Rasmin |
| TCP | 1047 | GateCrasher |
| TCP | 1050 | MiniCommand |
| TCP | 1059 | nimreg |
| TCP | 1069 | Backdoor.TheefServer.202 |
| TCP | 1070 | Voice,Psyber Stream Server,Streaming Audio Trojan |
| TCP | 1080 | Wingate,Worm.BugBear.B,Worm.Novarg.B |
| TCP | 1090 | Xtreme,VDOLive |
| TCP | 1092 | LoveGate |
| TCP | 1095 | Rat |
| TCP | 1097 | Rat |
| TCP | 1098 | Rat |
| TCP | 1099 | Rat |
| TCP | 1110 | nfsd-keepalive |
| TCP | 1111 | Backdoor.AIMVision |
| TCP | 1155 | Network File Access |
| TCP | 1170 | Psyber Stream Server,Streaming Audio trojan,Voice |
| TCP | 1200 | NoBackO |
| TCP | 1201 | NoBackO |
| TCP | 1207 | Softwar |
| TCP | 1212 | Nirvana,Visul Killer |
| TCP | 1234 | Ultors |
| TCP | 1243 | BackDoor-G,SubSeven,SubSeven Apocalypse |
| TCP | 1245 | VooDoo Doll |
| TCP | 1269 | Mavericks Matrix |
| TCP | 1313 | Nirvana |
| TCP | 1349 | BioNet |
| TCP | 1433 | Microsoft SQL服务 |
| TCP | 1441 | Remote Storm |
| TCP | 1492 | FTP99CMP(BackOriffice.FTP) |
| TCP | 1503 | NetMeeting T.120 |
| TCP | 1509 | Psyber Streaming Server |
| TCP | 1600 | Shivka-Burka |
| TCP | 1688 | Key Management Service(密钥管理服务) |
| TCP | 1703 | Exloiter 1.1 |
| TCP | 1720 | NetMeeting H.233 call Setup |
| TCP | 1723 | VPN 网关(PPTP) |
| TCP | 1731 | NetMeeting音频调用控制 |
| TCP | 1807 | SpySender |
| TCP | 1966 | Fake FTP 2000 |
| TCP | 1976 | Custom port |
| TCP | 1981 | Shockrave |
| TCP | 1990 | stun-p1 cisco STUN Priority 1 port |
| TCP | 1990 | stun-p1 cisco STUN Priority 1 port |
| TCP | 1991 | stun-p2 cisco STUN Priority 2 port |
| TCP | 1992 | stun-p3 cisco STUN Priority 3 port,ipsendmsg IPsendmsg |
| TCP | 1993 | snmp-tcp-port cisco SNMP TCP port |
| TCP | 1994 | stun-port cisco serial tunnel port |
| TCP | 1995 | perf-port cisco perf port |
| TCP | 1996 | tr-rsrb-port cisco Remote SRB port |
| TCP | 1997 | gdp-port cisco Gateway Discovery Protocol |
| TCP | 1998 | x25-svc-port cisco X.25 service (XOT) |
| TCP | 1999 | BackDoor,TransScout |
| TCP | 2000 | Der Spaeher,INsane Network |
| TCP | 2002 | W32. Beagle .AX @mm |
| TCP | 2001 | Transmisson scout |
| TCP | 2002 | Transmisson scout |
| TCP | 2003 | Transmisson scout |
| TCP | 2004 | Transmisson scout |
| TCP | 2005 | TTransmisson scout |
| TCP | 2011 | cypress |
| TCP | 2015 | raid-cs |
| TCP | 2023 | Ripper,Pass Ripper,Hack City Ripper Pro |
| TCP | 2049 | NFS |
| TCP | 2115 | Bugs |
| TCP | 2121 | Nirvana |
| TCP | 2140 | Deep Throat,The Invasor |
| TCP | 2155 | Nirvana |
| TCP | 2208 | RuX |
| TCP | 2255 | Illusion Mailer |
| TCP | 2283 | HVL Rat5 |
| TCP | 2300 | PC Explorer |
| TCP | 2311 | Studio54 |
| TCP | 2556 | Worm.Bbeagle.q |
| TCP | 2565 | Striker |
| TCP | 2583 | WinCrash |
| TCP | 2600 | Digital RootBeer |
| TCP | 2716 | Prayer Trojan |
| TCP | 2745 | Worm.BBeagle.k |
| TCP | 2773 | Backdoor,SubSeven |
| TCP | 2774 | SubSeven2.1&2.2 |
| TCP | 2801 | Phineas Phucker |
| TCP | 2989 | Rat |
| TCP | 3024 | WinCrash trojan |
| TCP | 3127 | Worm.Novarg |
| TCP | 3128 | RingZero,Worm.Novarg.B |
| TCP | 3129 | Masters Paradise |
| TCP | 3150 | Deep Throat,The Invasor |
| TCP | 3198 | Worm.Novarg |
| TCP | 3210 | SchoolBus |
| TCP | 3332 | Worm.Cycle.a |
| TCP | 3333 | Prosiak |
| TCP | 3389 | 超级终端(远程桌面) |
| TCP | 3456 | Terror |
| TCP | 3459 | Eclipse 2000 |
| TCP | 3700 | Portal of Doom |
| TCP | 3791 | Eclypse |
| TCP | 3801 | Eclypse |
| TCP | 3996 | Portal of Doom,RemoteAnything |
| TCP | 4000 | 腾讯QQ客户端 |
| TCP | 4060 | Portal of Doom,RemoteAnything |
| TCP | 4092 | WinCrash |
| TCP | 4242 | VHM |
| TCP | 4267 | SubSeven2.1&2.2 |
| TCP | 4321 | BoBo |
| TCP | 4444 | Prosiak,Swift remote |
| TCP | 4500 | W32.HLLW.Tufas |
| TCP | 4567 | File Nail |
| TCP | 4590 | ICQTrojan |
| TCP | 4899 | Remote Administrator服务器 |
| TCP | 4950 | ICQTrojan |
| TCP | 5000 | WindowsXP服务器,Blazer 5,Bubbel,Back Door Setup,Sockets de Troie |
| TCP | 5001 | Back Door Setup,Sockets de Troie |
| TCP | 5002 | cd00r,Shaft |
| TCP | 5011 | One of the Last Trojans (OOTLT) |
| TCP | 5025 | WM Remote KeyLogger |
| TCP | 5031 | Firehotcker,Metropolitan,NetMetro |
| TCP | 5032 | Metropolitan |
| TCP | 5190 | ICQ Query |
| TCP | 5321 | Firehotcker |
| TCP | 5333 | Backage Trojan Box 3 |
| TCP | 5343 | WCrat |
| TCP | 5400 | Blade Runner,BackConstruction1.2 |
| TCP | 5401 | Blade Runner,Back Construction |
| TCP | 5402 | Blade Runner,Back Construction |
| TCP | 5471 | WinCrash |
| TCP | 5512 | Illusion Mailer |
| TCP | 5521 | Illusion Mailer |
| TCP | 5550 | Xtcp,INsane Network |
| TCP | 5554 | Worm.Sasser |
| TCP | 5555 | ServeMe |
| TCP | 5556 | BO Facil |
| TCP | 5557 | BO Facil |
| TCP | 5569 | Robo-Hack |
| TCP | 5598 | BackDoor 2.03 |
| TCP | 5631 | PCAnyWhere data |
| TCP | 5632 | PCAnyWhere |
| TCP | 5637 | PC Crasher |
| TCP | 5638 | PC Crasher |
| TCP | 5698 | BackDoor |
| TCP | 5714 | Wincrash3 |
| TCP | 5741 | WinCrash3 |
| TCP | 5742 | WinCrash |
| TCP | 5760 | Portmap Remote Root Linux Exploit |
| TCP | 5880 | Y3K RAT |
| TCP | 5881 | Y3K RAT |
| TCP | 5882 | Y3K RAT |
| TCP | 5888 | Y3K RAT |
| TCP | 5889 | Y3K RAT |
| TCP | 5900 | WinVnc |
| TCP | 6000 | Backdoor.AB |
| TCP | 6006 | Noknok8 |
| TCP | 6129 | Dameware Nt Utilities服务器 |
| TCP | 6272 | SecretService |
| TCP | 6267 | 广外女生 |
| TCP | 6400 | Backdoor.AB,The Thing |
| TCP | 6500 | Devil 1.03 |
| TCP | 6661 | Teman |
| TCP | 6666 | TCPshell.c |
| TCP | 6667 | NT Remote Control,Wise 播放器接收端口 |
| TCP | 6668 | Wise Video广播端口 |
| TCP | 6669 | Vampyre |
| TCP | 6670 | DeepThroat,iPhone |
| TCP | 6671 | Deep Throat 3.0 |
| TCP | 6711 | SubSeven |
| TCP | 6712 | SubSeven1.x |
| TCP | 6713 | SubSeven |
| TCP | 6723 | Mstream |
| TCP | 6767 | NT Remote Control |
| TCP | 6771 | DeepThroat |
| TCP | 6776 | BackDoor-G,SubSeven,2000 Cracks |
| TCP | 6777 | Worm.BBeagle |
| TCP | 6789 | Doly Trojan |
| TCP | 6838 | Mstream |
| TCP | 6883 | DeltaSource |
| TCP | 6912 | Shit Heep |
| TCP | 6939 | Indoctrination |
| TCP | 6969 | GateCrasher,Priority,IRC 3 |
| TCP | 6970 | RealAudio,GateCrasher |
| TCP | 7000 | Remote Grab,NetMonitor,SubSeven1.x |
| TCP | 7001 | Freak88 |
| TCP | 7201 | NetMonitor |
| TCP | 7215 | BackDoor-G,SubSeven |
| TCP | 7001 | Freak88,Freak2k |
| TCP | 7300 | NetMonitor |
| TCP | 7301 | NetMonitor |
| TCP | 7306 | NetMonitor,NetSpy 1.0 |
| TCP | 7307 | NetMonitor,ProcSpy |
| TCP | 7308 | NetMonitor,X Spy |
| TCP | 7323 | Sygate服务器端 |
| TCP | 7424 | Host Control |
| TCP | 7511 | 聪明基因 |
| TCP | 7597 | Qaz |
| TCP | 7609 | Snid X2 |
| TCP | 7626 | 冰河 |
| TCP | 7777 | The Thing |
| TCP | 7789 | Back Door Setup,ICQKiller |
| TCP | 7983 | Mstream |
| TCP | 8000 | 腾讯OICQ服务器端,XDMA |
| TCP | 8010 | Wingate,Logfile |
| TCP | 8011 | WAY2.4 |
| TCP | 8080 | WWW 代理,Ring Zero,Chubo,Worm.Novarg.B |
| TCP | 8102 | 网络神偷 |
| TCP | 8181 | W32.Erkez.D@mm |
| TCP | 8520 | W32.Socay.Worm |
| TCP | 8594 | I-Worm/Bozori.a |
| TCP | 8787 | BackOfrice 2000 |
| TCP | 8888 | Winvnc |
| TCP | 8897 | Hack Office,Armageddon |
| TCP | 8989 | Recon |
| TCP | 9000 | Netministrator |
| TCP | 9325 | Mstream |
| TCP | 9400 | InCommand 1.0 |
| TCP | 9401 | InCommand 1.0 |
| TCP | 9402 | InCommand 1.0 |
| TCP | 9872 | Portal of Doom |
| TCP | 9873 | Portal of Doom |
| TCP | 9874 | Portal of Doom |
| TCP | 9875 | Portal of Doom |
| TCP | 9876 | Cyber Attacker |
| TCP | 9878 | TransScout |
| TCP | 9989 | Ini-Killer |
| TCP | 9898 | Worm.Win32.Dabber.a |
| TCP | 9999 | Prayer Trojan |
| TCP | 10067 | Portal of Doom |
| TCP | 10080 | Worm.Novarg.B |
| TCP | 10084 | Syphillis |
| TCP | 10085 | Syphillis |
| TCP | 10086 | Syphillis |
| TCP | 10101 | BrainSpy |
| TCP | 10167 | Portal Of Doom |
| TCP | 10168 | Worm.Supnot.78858.c,Worm.LovGate.T |
| TCP | 10520 | Acid Shivers |
| TCP | 10607 | Coma trojan |
| TCP | 10666 | Ambush |
| TCP | 11000 | Senna Spy |
| TCP | 11050 | Host Control |
| TCP | 11051 | Host Control |
| TCP | 11223 | Progenic,Hack ’99KeyLogger |
| TCP | 11831 | TROJ_LATINUS.SVR |
| TCP | 12076 | Gjamer,MSH.104b |
| TCP | 12223 | Hack’99 KeyLogger |
| TCP | 12345 | GabanBus,NetBus 1.6/1.7,Pie Bill Gates,X-bill |
| TCP | 12346 | GabanBus,NetBus 1.6/1.7,X-bill |
| TCP | 12349 | BioNet |
| TCP | 12361 | Whack-a-mole |
| TCP | 12362 | Whack-a-mole |
| TCP | 12363 | Whack-a-mole |
| TCP | 12378 | W32/Gibe@MM |
| TCP | 12456 | NetBus |
| TCP | 12623 | DUN Control |
| TCP | 12624 | Buttman |
| TCP | 12631 | WhackJob,WhackJob.NB1.7 |
| TCP | 12701 | Eclipse2000 |
| TCP | 12754 | Mstream |
| TCP | 13000 | Senna Spy |
| TCP | 13010 | Hacker Brazil |
| TCP | 13013 | Psychward |
| TCP | 13223 | Tribal Voice的聊天程序PowWow |
| TCP | 13700 | Kuang2 The Virus |
| TCP | 14456 | Solero |
| TCP | 14500 | PC Invader |
| TCP | 14501 | PC Invader |
| TCP | 14502 | PC Invader |
| TCP | 14503 | PC Invader |
| TCP | 15000 | NetDaemon 1.0 |
| TCP | 15092 | Host Control |
| TCP | 15104 | Mstream |
| TCP | 16484 | Mosucker |
| TCP | 16660 | Stacheldraht (DDoS) |
| TCP | 16772 | ICQ Revenge |
| TCP | 16959 | Priority |
| TCP | 16969 | Priority |
| TCP | 17027 | 提供广告服务的Conducent”adbot”共享软件 |
| TCP | 17166 | Mosaic |
| TCP | 17300 | Kuang2 The Virus |
| TCP | 17490 | CrazyNet |
| TCP | 17500 | CrazyNet |
| TCP | 17569 | Infector 1.4.x + 1.6.x |
| TCP | 17777 | Nephron |
| TCP | 18753 | Shaft (DDoS) |
| TCP | 19191 | 蓝色火焰 |
| TCP | 19864 | ICQ Revenge |
| TCP | 20000 | Millennium II (GrilFriend) |
| TCP | 20001 | Millennium II (GrilFriend) |
| TCP | 20002 | AcidkoR |
| TCP | 20034 | NetBus 2 Pro |
| TCP | 20168 | Lovgate |
| TCP | 20203 | Logged,Chupacabra |
| TCP | 20331 | Bla |
| TCP | 20432 | Shaft (DDoS) |
| TCP | 20808 | Worm.LovGate.v.QQ |
| TCP | 213 35 | Tribal Flood Network,Trinoo |
| TCP | 21544 | Schwindler 1.82,GirlFriend |
| TCP | 21554 | Schwindler 1.82,GirlFriend,Exloiter 1.0.1.2 |
| TCP | 22222 | Prosiak,RuXUploader2.0 |
| TCP | 22784 | Backdoor.Intruzzo |
| TCP | 23432 | Asylum 0.1.3 |
| TCP | 23444 | 网络公牛 |
| TCP | 23456 | Evil FTP,Ugly FTP,WhackJob |
| TCP | 23476 | Donald Dick |
| TCP | 23477 | Donald Dick |
| TCP | 23777 | INet Spy |
| TCP | 26274 | Delta |
| TCP | 26681 | Spy Voice |
| TCP | 27374 | Sub Seven 2.0+,Backdoor.Baste |
| TCP | 27444 | Tribal Flood Network,Trinoo |
| TCP | 27665 | Tribal Flood Network,Trinoo |
| TCP | 29431 | Hack Attack |
| TCP | 29432 | Hack Attack |
| TCP | 29104 | Host Control |
| TCP | 29559 | TROJ_LATINUS.SVR |
| TCP | 29891 | The Unexplained |
| TCP | 30001 | Terr0r32 |
| TCP | 30003 | Death,Lamers Death |
| TCP | 30029 | AOL trojan |
| TCP | 30100 | NetSphere 1.27a,NetSphere 1.31 |
| TCP | 30101 | NetSphere 1.31,NetSphere 1.27a |
| TCP | 30102 | NetSphere 1.27a,NetSphere 1.31 |
| TCP | 30103 | NetSphere 1.31 |
| TCP | 30303 | Sockets de Troie |
| TCP | 30722 | W32.Esbot.A |
| TCP | 30947 | Intruse |
| TCP | 30999 | Kuang2 |
| TCP | 31336 | Bo Whack |
| TCP | 31337 | Baron Night,BO client,BO2,Bo Facil,BackFire,Back Orifice,DeepBO,Freak2k,NetSpy |
| TCP | 31338 | NetSpy,Back Orifice,DeepBO |
| TCP | 31339 | NetSpy DK |
| TCP | 31554 | Schwindler |
| TCP | 31666 | BOWhack |
| TCP | 31778 | Hack Attack |
| TCP | 31785 | Hack Attack |
| TCP | 31787 | Hack Attack |
| TCP | 31789 | Hack Attack |
| TCP | 31791 | Hack Attack |
| TCP | 31792 | Hack Attack |
| TCP | 32100 | PeanutBrittle |
| TCP | 32418 | Acid Battery |
| TCP | 33333 | Prosiak,Blakharaz 1.0 |
| TCP | 33577 | Son Of Psychward |
| TCP | 33777 | Son Of Psychward |
| TCP | 33911 | Spirit 2001a |
| TCP | 34324 | BigGluck,TN,Tiny Telnet Server |
| TCP | 34555 | Trin00 (Windows) (DDoS) |
| TCP | 35555 | Trin00 (Windows) (DDoS) |
| TCP | 36794 | Worm.Bugbear-A |
| TCP | 37651 | YAT |
| TCP | 40412 | The Spy |
| TCP | 40421 | Agent 40421,Masters Paradise.96 |
| TCP | 40422 | Masters Paradise |
| TCP | 40423 | Masters Paradise.97 |
| TCP | 40425 | Masters Paradise |
| TCP | 40426 | Masters Paradise 3.x |
| TCP | 41666 | Remote Boot |
| TCP | 43210 | Schoolbus 1.6/2.0 |
| TCP | 44444 | Delta Source |
| TCP | 44445 | Happypig |
| TCP | 45576 | 未知代理 |
| TCP | 47252 | Prosiak |
| TCP | 47262 | Delta |
| TCP | 47878 | BirdSpy2 |
| TCP | 49301 | Online Keylogger |
| TCP | 50505 | Sockets de Troie |
| TCP | 50766 | Fore,Schwindler |
| TCP | 51966 | CafeIni |
| TCP | 53001 | Remote Windows Shutdown |
| TCP | 53217 | Acid Battery 2000 |
| TCP | 54283 | Back Door-G,Sub7 |
| TCP | 54320 | Back Orifice 2000,Sheep |
| TCP | 54321 | School Bus .69-1.11,Sheep,BO2K |
| TCP | 57341 | NetRaider |
| TCP | 58008 | BackDoor.Tron |
| TCP | 58009 | BackDoor.Tron |
| TCP | 58339 | ButtFunnel |
| TCP | 59211 | BackDoor.DuckToy |
| TCP | 60000 | Deep Throat |
| TCP | 60068 | Xzip 6000068 |
| TCP | 60268 | DaYangou_bigppig |
| TCP | 60411 | Connection |
| TCP | 60606 | TROJ_BCKDOR.G2.A |
| TCP | 61466 | Telecommando |
| TCP | 61603 | Bunker-kill |
| TCP | 63485 | Bunker-kill |
| TCP | 65000 | Devil,DDoS |
| TCP | 65432 | Th3tr41t0r,The Traitor |
| TCP | 65530 | TROJ_WINMITE.10 |
| TCP | 65535 | RC,Adore Worm/Linux |