Loading...
[get complete service list]
Top of page
Port Information
Protocol Service Name
tcp ADB Android Debug Bridge
tcp personal-agent Personal Agent
tcp ServeMe [trojan] ServeMe
udp personal-agent Personal Agent
udp rplay rplay
tcp TR069 Router Remote Admin
Top IPs Scanning
Today Yesterday
141.98.11.154 (1701)141.98.11.154 (6956)
45.200.149.215 (1262)45.200.149.215 (5291)
156.233.225.59 (1111)156.233.225.59 (4295)
103.211.200.104 (943)103.211.200.104 (3790)
154.213.187.6 (501)178.215.238.114 (2057)
209.141.37.138 (479)154.213.187.6 (1789)
185.224.128.17 (371)178.215.238.36 (1458)
45.200.148.174 (231)45.200.148.174 (936)
45.200.149.63 (173)185.224.128.17 (924)
154.213.190.246 (150)43.158.217.137 (920)
Port diary mentions
URL
Worm (Mirai?) Exploiting Android Debug Bridge (Port 5555tcp)
Does it matter if iptables isn't running on my honeypot?
Top of page
User Comments
Submitted By Date
Comment
Josiah 2019-06-07 06:37:31
Default port for the Monyog software or I think Idera is renaming it "SQL Diagnostics for MySQL".
Johannes 2018-07-15 11:17:50
Port 5555 is used by the Android Debug Bridge. A feature that is usually turned off. But it has been discovered that some (in particular chinese) Android phones ship with it turned on. Also, during jailbreak, the ADB feature is sometimes turned on.
George 2013-09-11 12:14:55
Legitimate use of this port: Sun xFire servers (x4100, 4140, 4500, 4540) may use this port for out-of-band / ILOM remote control of the server with latest revisions of the ILOM firmware. However, this traffic would be sporadic and on an as-needed basis (hopefully people aren't using ILOM to log into servers for day-to-day work). One would also see HTTPS (443) traffic from the same IP's, to load the ILOM services pages and invoke the remote control functions.
2011-08-10 01:36:26
MS Dynamics CRM uses this port by default
Don Levinson 2004-09-08 06:30:35
We are seeing heavy target traffic on this port. Many of our machines are infected with bling.exe which is listed as non-malicious spyware, but it is acting like backdoor software from what I can see. Infection is seen with the files bling.exe and o. in the system32 directory on windows. Activity is TCP from an incrementing port on the infected PC to a fixed port of 5555 on the network target/master.
2003-08-21 19:33:01
Other programs that use port 5555: freeciv HP Omniback
Top of page
CVE Links
CVE # Description
CVE-2013-6194 Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905.
CVE-2014-2623
CVE-2016-2005
Top of page