DEV Community

andreagomez
andreagomez

Posted on

Legacy Plaintext Ports Outnumber Everything Else

#zoomeye #measurement #ftp #legacyprotocols

Legacy Plaintext Ports Outnumber Everything Else

On 28 October 2026, ZoomEye reported 10,378,037 matches for port 21. The same collection returned 3,677,260 for port 443. FTP, a protocol with no encryption in its original form, produced nearly three times the port count of HTTPS.

The numbers

Port 21 returned 10,378,037. Port 25 returned 174,287. Port 53 returned 22,258. Port 443 returned 3,677,260. Application fingerprint app:"ProFTPD" returned 26.
That last figure is the interesting one. Ten million services answer on 21, and twenty-six are identified as one of the most widely deployed FTP daemons on the planet. The count is not a measure of ProFTPD usage. It is a measure of how little the platform can attribute on that port.

Why FTP counts stay high

File transfer is embedded in industrial workflows. Printers, scanners, multifunction devices, manufacturing equipment, backup appliances and network gear all ship with FTP as the lowest common denominator for moving files. None of these devices has a reason to expose a rich banner, and most of them never receive a firmware update that would change one.
The traffic pattern also favours persistence. A device that exists to receive scanned documents over FTP keeps that service enabled for its whole service life, because disabling it breaks the workflow that justified the purchase.
The consequence is a very large population of services that are simple to count and hard to attribute, running a protocol that sends credentials in the clear.

A note on comparability

A port count and a product count are not the same kind of measurement, and the 10,378,037 figure says nothing about how many of those services accept anonymous login, how many are writable, or how many are reachable from the public internet with useful data behind them. It says that the port is answering.
That distinction matters when the number is used in a board presentation. Ten million exposed FTP services sounds alarming. Ten million listening endpoints, some fraction of which are public and some fraction of which are misconfigured, is the accurate framing.

SMTP and DNS for scale

The 174,287 port-25 matches and 22,258 port-53 matches show the same long-tail behaviour at smaller scale. Mail relay and name resolution are services that must answer, so they answer on well-known ports, and the population is stable year over year.
For DNS specifically, an open resolver is a different finding from a listening resolver, and a port count cannot distinguish them. The exposure question requires a query, not a count.

What an owner should take from this

Inventory the devices, not just the servers. The FTP service on a scanner is an asset with a firmware version, a credential and a network path, and it belongs in the same register as the file server.
Where FTP is still required, prefer a mode with TLS and confirm that the client devices support it. Where it is not required, disable the service rather than filtering it, because a filtered service comes back the moment the rule changes.
Check whether the service is writable. An anonymous read-only FTP directory is a disclosure problem; a writable one is a storage and delivery problem.
Finally, do not use product fingerprints to size this population. Use the port, then verify by hand on the hosts that matter.

References

Top comments (0)