Anyone know these listening ports/vendors used?
This report discusses observations of specific high-numbered listening ports seen in limited source connections, primarily from IPs associated with China, the United States, and the United Kingdom. The post questions which vendors or software might be associated with these ports, suggesting possibilities such as building management systems, industrial controllers, command and control compromised hosts, or torrent software. No explicit vulnerability or exploit is described, and no affected software versions are identified.
AI Analysis
Technical Summary
A Reddit post references a GitHub data source listing top listening ports observed in honeypot firewall statistics. The post highlights several high-numbered ports with limited but specific connection attempts, primarily from certain countries. The author speculates on the nature of the services behind these ports but provides no concrete identification or evidence of vulnerabilities or exploits. No technical details about the protocols or software behind these ports are provided, and no known exploits or CVEs are associated.
Potential Impact
No direct impact is described or confirmed. The data indicates unusual connection attempts to specific high ports, but without further analysis or identification of vulnerable software, no concrete security impact can be determined.
Mitigation Recommendations
No specific mitigation guidance is provided or applicable given the lack of identified vulnerabilities or exploits. Monitoring unusual port activity and investigating unknown listening services is standard practice but not explicitly recommended by the source.
Anyone know these listening ports/vendors used?
Description
This report discusses observations of specific high-numbered listening ports seen in limited source connections, primarily from IPs associated with China, the United States, and the United Kingdom. The post questions which vendors or software might be associated with these ports, suggesting possibilities such as building management systems, industrial controllers, command and control compromised hosts, or torrent software. No explicit vulnerability or exploit is described, and no affected software versions are identified.
Reddit Discussion
In our general reporting under TOP 150 ports (2nd section) https://github.com/sky-poppy/fwfeed/blob/main/blocklist_honeypot_firewall_stats.txt I have observed some random high up ports being specifically asked by a minority of connections.
The country is not important as obviously a DC source typically but what vendor/software are these listening ports associated with?
As its limited in source connections and very specific high port numbers, there is more than port scanning going on here so I would see this as hunting for something like...
- Building management software?
- Controllers of sorts ie power, fire? (ie honeywell or similar)
- C&C compromised host listening ports?
- Torrent software, maybe a zero day in client software?
44697 China
45330 China
43373 China United States
45417 China
42944 China United States
44090 China United States
43113 China United States
42781 China United Kingdom
44789 China
45232 China
43401 China United States
Ideas for listening vendor ports?
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
A Reddit post references a GitHub data source listing top listening ports observed in honeypot firewall statistics. The post highlights several high-numbered ports with limited but specific connection attempts, primarily from certain countries. The author speculates on the nature of the services behind these ports but provides no concrete identification or evidence of vulnerabilities or exploits. No technical details about the protocols or software behind these ports are provided, and no known exploits or CVEs are associated.
Potential Impact
No direct impact is described or confirmed. The data indicates unusual connection attempts to specific high ports, but without further analysis or identification of vulnerable software, no concrete security impact can be determined.
Mitigation Recommendations
No specific mitigation guidance is provided or applicable given the lack of identified vulnerabilities or exploits. Monitoring unusual port activity and investigating unknown listening services is standard practice but not explicitly recommended by the source.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true,"foundNewsworthy":[],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a4c0e3f27e9c797192a8130
Added to database: 07/06/2026, 20:21:19 UTC
Last enriched: 07/06/2026, 20:21:25 UTC
Last updated: 07/07/2026, 02:51:16 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.