Top 10 Trouble Ports For 12 hours on July 22, we collected data from 24 firewalls sitting between the internal networks of 24 Ohio-based businesses and the Internet backbone served to them by their regional ISP. There were 12,000 incidents where blocked ports were attacked by hackers. Here’s the most popular ports of call. Port number Services Incident count Incident count 135 and 445 Windows RPC 42 and 457 respectively Outbound attempts indicate you could have the latest Windows virus/worm. 57 Email 56 Hackers use FX Tools to scan this port for vulnerabilities in Microsoft-based Web servers. 1080, 3128, 6588, 8080 Proxy services 64,21,21,163 respectively Indicative of hacker scanning activity. 25 SMTP services 56 Signals probing for SMTP servers to relay spam. 10,000 plus No registered services 376 Hits on these ports are usually return traffic. Investigation may reveal computer/firewall misconfigurations, or an attack using an attempt to impersonate return traffic. 161 SNMP services 937 Successful SNMP can give hacker complete control of routers, firewall, or switches. 1433 Microsoft SQL services 147 Outbound attempts may indicate your network is infected with SQL slammer worm. 53 DNS 1797 Could indicate firewall or LAN configuration issues. 67 Bootstrap 23 Can indicate misconfigured equipment. 2847 Norton anti-virus 55 Attempts on this port meant machines were misconfigured.