Read the incident
Identify what the user, server or administrator needs to do.
NETWORK SIEGEPORTPANIC’95
CHOOSE THE PORT. STOP THE CLOCK.
EMERGENCY CHANNEL // INCOMING THREATFIFTEEN PORTS.
FIFTEEN PORTS.
ONE WAY OUT.
Read the incident brief and connect the service to the correct physical socket before the timer reaches zero. Correct answers add four seconds. Wrong answers remove eight seconds and arm a strike.
+4 SEC−8 SEC3 STRIKES = BOOM
32 PORT SCENARIOS3 DIFFICULTY TIERS30 SECOND START0 DOWNLOADS
A port-number quiz wired like an action thriller.
Port Panic ’95 turns common network ports into fast decisions. DirtyPhish has armed a fictional server city: route fifteen service requests to the correct socket before the countdown or three mistakes trigger his demolition sequence.
Choose a socket
Tap one of two port numbers, or press the matching 1 or 2 key.
Protect the clock
A correct route adds four seconds. A wrong route removes eight.
Stop DirtyPhish
Connect fifteen services before the timer or three-strike limit ends.
What is a network port?
A network port is a numbered logical endpoint that helps a computer deliver TCP or UDP traffic to the correct service. Think of the IP address as the building address and the port number as a labelled destination inside it. There are 65,536 possible port numbers, from 0 through 65535. Many protocols have widely used defaults, but administrators can change them.
Front-door services
22 · 23 · 80 · 443 · 3389SSH, Telnet, HTTP, HTTPS and Remote Desktop are memorable high-value entry points. Learn the defaults, then learn why direct exposure must be tightly controlled.
Mail transport and access
25 · 110 · 143 · 465 · 587 · 993 · 995Separate server relay, authenticated submission and mailbox retrieval. TLS-protected IMAPS and POP3S use different defaults from their legacy counterparts.
Name, time and addressing
53 · 67/68 · 88 · 123 · 161/162DNS, DHCP, Kerberos, NTP and SNMP keep networks usable and observable. Several use UDP, while some can use both transport protocols.
Directories and shares
389 · 445 · 636 · 2049LDAP, LDAPS, SMB and NFS support identity lookups and shared storage. Because they expose valuable data, segmentation and access control matter.
Database defaults
1433 · 3306 · 5432 · 6379Microsoft SQL Server, MySQL, PostgreSQL and Redis have widely recognised defaults. Database listeners should normally remain on protected private networks.
Modern operations
5900 · 5986 · 6443 · 6514VNC, secure WinRM, the Kubernetes API and syslog over TLS represent remote operations, orchestration and protected log collection.
Common port numbers cheat sheet
| SERVICE | COMMON PORT | TRANSPORT | USE |
|---|---|---|---|
| SSH / Telnet | 22 / 23 | TCP | Encrypted / plaintext remote shell |
| HTTP / HTTPS | 80 / 443 | TCP | Web traffic |
| DNS | 53 | TCP + UDP | Name resolution |
| SMTP relay / submission | 25 / 587 | TCP | Server relay / authenticated sending |
| POP3 / POP3S | 110 / 995 | TCP | Download email |
| IMAP / IMAPS | 143 / 993 | TCP | Synchronise email |
| LDAP / LDAPS | 389 / 636 | TCP | Directory access |
| SMB / RDP | 445 / 3389 | TCP | File sharing / remote desktop |
!
Default ports are clues, not proof
A service can be moved to another port, and an attacker can deliberately imitate a familiar service. In real security work, combine authorised service discovery with asset inventories, configuration evidence, certificates, banners and logs. Never scan systems without permission.
Knowing the number is only the first control.
A firewall rule should reflect business need, source, destination, protocol and ownership, not just a memorised number. Reduce attack surface by closing unused listeners, limiting management services to trusted networks, requiring MFA where available, patching exposed software, encrypting sensitive connections and alerting on unexpected traffic. Port knowledge helps you ask the right question: should this service be reachable here at all?
What is a hacktivist and how is that different from cybercrime for money?
A hacktivist uses cyber activity to advance a political, social or ideological cause. The objective may be publicity, disruption, embarrassment or influence rather than payment. A financially motivated cybercriminal primarily wants profit through fraud, extortion, stolen accounts, cryptocurrency or resaleable data. Motivation helps an investigation form hypotheses, but it does not prove identity: real attackers may cooperate, change goals or invent a public story to hide their true purpose.
Hacktivist
Uses cyber activity to promote a political, social or ideological cause. Common goals include publicity, disruption, embarrassment or exposing information. The Port Panic villain is an exaggerated fictional example.
Financial cybercriminal
Seeks money through fraud, credential theft, payment diversion, ransomware, extortion, cryptocurrency theft or selling stolen access and data.
State-sponsored actor
Operates for a government or aligned interest to gather intelligence, influence events, pre-position access or disrupt another country, organisation or sector.
Insider threat
A current or former employee, contractor or partner who deliberately misuses legitimate access. An insider can also cause harm accidentally through negligence or manipulation.
Cybercrime specialist
Some groups divide the attack chain. One actor steals credentials or establishes access, then sells it to ransomware operators, fraud crews or data thieves.
Opportunist
May attack for curiosity, status, revenge or challenge rather than a clear financial or political objective. Low sophistication does not mean low impact.
!
Hacktivism is not automatically ethical hacking
Ethical security testing is authorised and follows an agreed scope. Hacktivist activity can still be unauthorised, damaging and illegal even when the actor claims a cause. DirtyPhish placing a physical bomb is deliberately exaggerated arcade fiction; real hacktivist incidents more commonly involve digital disruption, defacement, data theft or leaks.
Network ports: quick answers.
What is a network port?
A network port is a numbered logical endpoint used to direct TCP or UDP traffic to the right service on a device. An IP address identifies the host; the port helps identify the service.
What are ports 22 and 23 used for?
TCP port 22 is commonly used by SSH for encrypted remote administration. TCP port 23 is commonly used by Telnet, a legacy plaintext protocol that should not be used across untrusted networks.
What are ports 80 and 443?
TCP port 80 is the common default for HTTP. TCP port 443 is the common default for HTTPS, which protects web traffic with TLS when configured correctly.
Which ports do IMAP and POP3 use?
Traditional IMAP commonly uses TCP 143 and IMAPS uses 993. Traditional POP3 commonly uses TCP 110 and POP3S uses 995.
Does DNS use TCP or UDP port 53?
DNS commonly uses both UDP and TCP port 53. Ordinary queries often use UDP, while TCP can be used for larger replies, zone transfers and other cases.
Does an open port prove which application is running?
No. Default port numbers are useful clues, but services can be reconfigured and deceptive services can imitate expected behaviour. Defenders verify with authorised scanning, service identification, logs and asset records.
How should organisations secure exposed ports?
Expose only required services, restrict sources with firewalls and network segmentation, patch the service, require strong authentication, encrypt traffic and monitor logs for unusual connections.
What is a hacktivist?
A hacktivist uses hacking or disruptive digital activity to advance a political, social or ideological cause. Methods may include defacement, denial-of-service attacks, data theft or leaks. A claimed cause does not make unauthorised activity legal or harmless.
What is the difference between a hacktivist and a financially motivated cybercriminal?
The main difference is motive. Hacktivists typically seek attention, disruption or ideological influence, while financially motivated criminals pursue payment, fraud, resaleable data, extortion or cryptocurrency. Real incidents can involve mixed motives, so defenders rely on evidence rather than labels.
Is Port Panic ’95 free and mobile friendly?
Yes. The game is free, needs no account or download, and supports touch, mouse and the number keys 1 and 2.