Attackers overwhelmingly target a small set of well-known ports that expose remote-access and data services — chiefly 22 (SSH), 3389 (RDP), 445 (SMB), 23 (Telnet), 21 (FTP), and the database ports 3306 (MySQL), 1433 (MSSQL), 5432 (PostgreSQL), 6379 (Redis) and 27017 (MongoDB), alongside the high-volume web ports 80 (HTTP) and 443 (HTTPS). RDP on 3389 is the single most common initial-access vector for ransomware; SMB on 445 was the vector for the WannaCry and NotPetya outbreaks. The reason is efficiency: automated scanners like Nmap, masscan, and Shodan sweep the entire IPv4 internet in minutes, so any service left on its default port is discovered and probed almost immediately.
That is the summary an AI overview would give you. What it can't give you is the working reference below — a single table mapping each targeted port to its service, why attackers love it, and the specific hardening step that shuts it down — plus a clear rule for which ports should never touch the public internet at all. Bookmark the table; that is the part you will actually come back to.
Understanding Network Ports and Attack Vectors
Network ports are the gateways through which services communicate over the internet. Each port number between 0 and 65535 represents a potential entry point into your systems, but not all ports are equally attractive to attackers. Understanding which ports are most commonly targeted by cybercriminals is essential for developing effective network security strategies.
Security researchers consistently find that attackers focus their efforts on a relatively small set of well-known ports. This concentrated approach allows them to use vulnerability scanners and automated tools to rapidly identify and exploit exposed services across thousands of systems. By understanding which ports attract the most attention, organizations can prioritize their defensive measures and allocate security resources more effectively.
Commonly Targeted Ports at a Glance
The table below is the fast reference: each port attackers routinely target, the service behind it, why it draws fire, and the one hardening move that matters most. "Expose?" flags whether the port should ever be reachable from the public internet.
| Port | Service | Why attackers target it | Key hardening step | Expose to internet? |
|---|---|---|---|---|
| 21 | FTP | Credentials sent in plaintext; anonymous login often on by default | Replace with SFTP/FTPS; disable anonymous access | No |
| 22 | SSH | Direct shell access; mass-automated brute-force of weak/default creds | Key-based auth + MFA, disable password & root login, fail2ban | Only if hardened |
| 23 | Telnet | Everything (including passwords) sent in plaintext; legacy devices | Disable entirely; replace with SSH | Never |
| 25 | SMTP | Open-relay abuse, spam, spoofing, credential theft | Require auth + TLS; use 587/465 for submission | Mail servers only |
| 53 | DNS | Cache poisoning, DDoS amplification, hijacking | Deploy DNSSEC; restrict recursion; rate-limit | Authoritative only |
| 80 | HTTP | Web-app exploits (SQLi, XSS); traffic is unencrypted | Redirect to HTTPS; front with a WAF | Yes (redirect) |
| 110 / 143 | POP3 / IMAP | Plaintext mailbox credentials on legacy configs | Enforce TLS (995/993); disable plaintext auth | Mail servers only |
| 443 | HTTPS | Universal web port; app flaws, TLS bugs (e.g. Heartbleed), cert abuse | Modern TLS config, patch promptly, WAF | Yes |
| 445 | SMB | EternalBlue/WannaCry/NotPetya; file-share access & lateral movement | Disable SMBv1; block at perimeter; patch (MS17-010) | Never |
| 1433 | MSSQL | Direct database access; brute-force sa; data theft & ransomware | Firewall allow-list; no internet exposure; strong auth | Never |
| 3306 | MySQL | Exposed DBs found in hours by Shodan; data exfiltration & wiping | Bind to localhost/VPN; firewall allow-list | Never |
| 3389 | RDP | #1 ransomware entry point; credential brute-force, full desktop control | VPN/RD Gateway + NLA + MFA; lock to known IPs | Never |
| 5432 | PostgreSQL | Same class as MySQL: direct data access, automated scanning | Restrict listen_addresses; VPN + allow-list | Never |
| 5900 | VNC | Often no/weak auth; full remote screen control | Tunnel over SSH/VPN; require strong auth | Never |
| 6379 | Redis | Historically no auth by default; RCE via config abuse | Require auth, bind to localhost, protected-mode on | Never |
| 27017 | MongoDB | Default no-auth instances mass-breached and ransomed | Enable auth; bind to private interfaces only | Never |
The Top Three Most Targeted Ports
According to research from Alert Logic and other major cybersecurity firms, three ports account for approximately 65% of all port-based vulnerability attempts: Port 22 (SSH), Port 80 (HTTP), and Port 443 (HTTPS).
Port 22 - SSH (Secure Shell)
SSH is used for remote administration and secure command-line access to systems. Despite being designed for security, Port 22 is one of the most frequently attacked ports globally because:
- Organizations often expose SSH directly to the internet for remote administration
- Many systems run SSH with weak default credentials or outdated versions
- Brute-force attacks on SSH are highly automated and readily available
- Successful SSH compromise gives attackers direct system access
Common attacks on Port 22 include dictionary attacks, brute-force password attempts, and exploits targeting vulnerable SSH server versions. Organizations that run SSH should implement strict access controls, use key-based authentication, disable password authentication, change the default port, and maintain up-to-date software.
Port 80 - HTTP (Hypertext Transfer Protocol)
Port 80 is the standard port for unencrypted web traffic. Attackers target this port to:
- Exploit web application vulnerabilities such as SQL injection or cross-site scripting (XSS)
- Conduct man-in-the-middle attacks on unencrypted traffic
- Deface websites
- Distribute malware
- Perform credential harvesting
Since HTTP traffic is unencrypted, attackers can intercept and modify data in transit. This makes Port 80 an attractive target for credential theft and malware distribution. The primary defense is migrating entirely to HTTPS and implementing web application firewalls.
Port 443 - HTTPS (Hypertext Transfer Protocol Secure)
Despite encryption, Port 443 remains heavily targeted because:
- It's the standard port for encrypted web traffic, making it harder for firewalls to block
- SSL/TLS vulnerabilities like Heartbleed have historically existed
- Man-in-the-middle attacks can compromise the SSL handshake
- Compromised certificates can enable attackers to intercept encrypted traffic
The fact that HTTPS is encrypted doesn't eliminate all risks. Attackers still target the protocol itself, the certificate infrastructure, and the underlying web applications.
Other Frequently Targeted Ports
Beyond the top three, several other ports attract significant attack traffic:
Port 21 - FTP (File Transfer Protocol)
FTP is one of the oldest internet protocols and remains vulnerable because:
- It transmits credentials in plain text
- Anonymous authentication is often enabled by default
- Directory traversal vulnerabilities are common
- It's deprecated in favor of SFTP and SCP
FTP usage should be eliminated entirely. Organizations needing file transfer capabilities should use SFTP (SSH File Transfer Protocol) on Port 22 or HTTPS-based file transfer services.
Port 23 - Telnet
Telnet is fundamentally insecure because all traffic, including authentication credentials, travels in plain text. It's largely obsolete but still targeted on legacy systems. Telnet should be completely disabled and replaced with SSH.
Port 25 - SMTP (Simple Mail Transfer Protocol)
SMTP on Port 25 is vulnerable to:
- Email spoofing attacks
- Phishing and spam relay attacks
- Credential theft during authentication
- Open relay exploitation
Modern mail systems should use SMTP with authentication and encryption (Port 587 for submission or Port 465 for SMTPS).
Port 53 - DNS (Domain Name System)
DNS serves as the infrastructure for domain name resolution and is targeted for:
- DNS cache poisoning attacks
- Distributed Denial of Service (DDoS) attacks
- DNS spoofing and hijacking
- DNS amplification attacks
Protecting DNS requires implementing DNSSEC, limiting DNS query sources, using DNS-over-HTTPS (DoH), and monitoring for anomalous query patterns.
Port 445 - SMB (Server Message Block)
SMB is used for file sharing and printer access on Windows networks. It became infamous during the WannaCry and NotPetya ransomware attacks through the EternalBlue vulnerability. Port 445 should:
- Never be exposed to the internet
- Be protected behind firewalls and VPNs
- Run the latest patched versions
- Have strong access controls
Port 3306 - MySQL
MySQL databases exposed on Port 3306 are frequently targeted for:
- Direct database access without web application layers
- Data theft and exfiltration
- Destructive attacks on database contents
- Lateral movement through database privileges
Databases should never be directly exposed to the internet. Use network segmentation and firewall rules to restrict access.
Port 3389 - RDP (Remote Desktop Protocol)
RDP enables remote desktop access to Windows systems but is heavily targeted through:
- Brute-force attacks on weak credentials
- Exploitation of RDP vulnerabilities
- Credential theft through compromised RDP clients
- Ransomware deployment after RDP compromise
RDP should be protected with network-level authentication, strong passwords, multi-factor authentication, and port forwarding through bastion hosts.
Why Attackers Focus on Specific Ports
Attackers concentrate on these ports because:
High-Value Services: These ports provide access to critical services like web applications, file transfer, and remote administration that can give attackers significant control.
Automation: Well-known ports can be scanned and exploited using readily available automated tools. Attackers can scan thousands of IP addresses quickly to find exposed services.
Public Facing: These ports are often exposed directly to the internet, making them accessible without advanced reconnaissance. Organizations frequently misconfigure firewalls or expose services unnecessarily.
Known Vulnerabilities: The software running on these ports (Apache, nginx, OpenSSH, Windows RDP) has extensive historical vulnerability databases that attackers can exploit.
Low Hanging Fruit: Systems running these services often have outdated software, weak credentials, or default configurations that make exploitation trivial.
Defensive Strategies
To protect against port-based attacks:
Network Segmentation: Don't expose services to the internet unless absolutely necessary. Use firewalls, network ACLs, and VPNs to restrict access.
Service Hardening: Keep software updated, disable unnecessary services, use strong authentication, and implement the principle of least privilege.
Port Changes: Change services from default ports (SSH on 2222 instead of 22) to reduce automated scanning effectiveness.
Monitoring: Monitor logs for connection attempts to restricted ports and unusual activity patterns.
Encryption: Use encrypted protocols (HTTPS, SFTP, SSH) instead of unencrypted alternatives.
Access Control: Implement multi-factor authentication, IP whitelisting, and network segmentation.
Vulnerability Management: Maintain an inventory of exposed ports, regularly scan for vulnerabilities, and remediate findings promptly.
Conclusion
Understanding which network ports attract the most attack traffic allows organizations to focus their limited security resources on the highest-impact defenses. While Port 22, 80, and 443 account for the majority of attacks, organizations must also secure the full range of services running on their networks. The most effective defense combines network segmentation, service hardening, access control, and continuous monitoring to detect and respond to attack attempts before they succeed.