The Most Common TCP Ports and Their Services
When looking at the output of a port scan, many hackers will know which service many of them correspond to. However, this does not necessarily show how common these ports are. This post highlights which ports are ACTUALLY most common on the internet and the services they most commonly run.
| Port | Common Service | Number of servers |
| 80 | Hypertext Transfer Protocol (HTTP) | 66,176,763 |
| 443 | HTTPS (Hypertext Transfer Protocol over SSL/TLS) | 53,584,827 |
| 7547 | CPE WAN Management Protocol Technical Report | 37,683,222 |
| 22 | Secure Shell (SSH)—used for secure logins, file transfers (scp, sftp) and port forwarding | 18,524,084 |
| 8080 | HTTP alternate | 10,161,093 |
| 5060 | Session Initiation Protocol | 9,824,113 |
| 53 | Domain Name System (DNS) | 9,284,076 |
| 21 | File Transfer Protocol(FTP) | 8,977,091 |
| 123 | Network Time Protocol (NTP) | 7,086,707 |
| 4567 | Sinatra default server port in development mode | 6,523,383 |
| 8089 | Splunk Daemon / Networker or Sun Solcitice Backup | 6,353,488 |
| 25 | Simple Mail Transfer Protocol | 5,694,829 |
| 8008 | EMC2 (Legato) Networker or Sun Solcitice Backup /TCP – HTTP Alternate / IBM HTTP Server administration default | 4,402,625 |
| 3389 | Windows Remote Desktop /Remote Assistance connections | 4,166,413 |
| 2000 | RemoteAnywhere | 4,163,712 |
| 554 | Real Time Streaming Protocol (RTSP) | 4,048,182 |
| 3306 | MySQL database system | 3,806,265 |
| 1723 | Microsoft Point-to-Point Tunneling Protocol | 3,635,916 |
| 993 | Internet Message Access Protocol over SSL | 3,535,499 |
| 110 | POP3 | 3,488,069 |
| 500 | ipsec | 3,482,985 |
| 587 | e-mail message submission (SMTP) | 3,449,937 |
| 8081 | HTTP alternate | 3,414,461 |
| 995 | Post Office Protocol 3 over TLS/SSL | 3,385,926 |
| 465 | URL Rendezvous Directory for SSM (Cisco protocol) | 3,288,388 |
| 23 | telnet | 3,229,786 |
| 179 | BGP (Border Gateway Protocol) | 3,221,281 |
| 143 | Internet Message Access Protocol (IMAP) | 3,127,869 |
| 2087 | WebHost Manager default SSL | 2,784,404 |
| 8000 | common alternative http port | 2,675,021 |
| 2083 | CPanel default SSL / Secure Radius Service (radsec) | 2,563,786 |
We have the information for over 38 thousand ports from port number 1 – 38020 using Shodan’s API that allows us to check the open ports for every device they have scanned. This is most likely one of the best sources for this information other than scanning every IP range and port range yourself. If you’re looking to build a most common port scan list as opposed to the NMAP top 1000, you can find the file right [here].