A round number near the top of the port space, remembered mainly for 1999-era DDoS handlers.
65000 is unregistered and unregisterable: RFC 6335 reserves 49152-65535 for dynamic and private use. Its 0.000760 frequency in Nmap's nmap-services reflects how often people pick round numbers for ad hoc listeners. The SANS ISC port page attaches a set of legacy backdoor and DDoS names to it — Devil, Sockets des Troie, and the Stacheldraht agent and handler, the last being a real 1999 distributed denial-of-service toolkit — all of which are historical rather than current threats. Today a listener here is far more likely to be someone's own service on a memorable port than any of those.
Expose with care
Round, memorable ports get scanned constantly and forgotten easily. Identify the process; if you cannot, close it rather than leaving it reachable.
$ sudo lsof -nP -iTCP:65000 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.