Overview of services running on Port 666 TCP.
~203 Thousand IP addresses observed from May to December 2012
To get raw lists of the data go to Download. For an explanation of what this data is and how it was obtained, see Paper.

Servicename Product Count Percent
httpthttpd19016293.382
sshOpenSSH27351.343
no match-/-17840.876
xml16980.834
chatAIM or ICQ server14530.714
httpMicrosoft IIS httpd7860.386
httplighttpd7230.355
http6970.342
httpMicrosoft HTTPAPI httpd3040.149
httpnginx2190.108
smtp2070.102
sshMikroTik RouterOS sshd1720.084
directconnectDirect Connect P2P1700.083
sshDropbear sshd1640.081
vncVNC1350.066
ftp1180.058
ftpFileZilla ftpd1150.056
ssh1040.051
vtunVtun Virtual Tunnel1030.051
qdsQlikView Distribution Service990.049
ftpMicrosoft ftpd960.047
httpBoa HTTPd920.045
ftpProFTPD830.041
http-proxyMikroTik http proxy770.038
remotingMS .NET Remoting services660.032
telnetMicrosoft Windows 2000 telnetd620.03
telnet610.03
httpdarkstat network analyzer httpd490.024
rtsp460.023
ftpServ-U ftpd450.022
smtpMicrosoft Exchange smtpd430.021
upnpMicrosoft Windows UPnP390.019
smtpPostfix smtpd350.017
httphttp server 1.0330.016
arcserveARCserve Discovery320.016
ftpPure-FTPd290.014
vncRealVNC Enterprise280.014
ftpvsftpd (before 2.0.8) or WU-FTPD230.011
httpGeoVision GeoHttpServer for webcams210.01
mysqlMySQL200.01
smtpMicrosoft ESMTP190.009
httpPanasonic webcam http config190.009
ftpGene6 ftpd180.009
httpBoa httpd170.008
httpUbicom160.008
sslTLS140.007
httpWorld Client WDaemon httpd140.007
httpRouter Webserver140.007
vncApple remote desktop vnc130.006
sshSCS sshd130.006
ftpSynology DiskStation NAS ftpd130.006
vncRealVNC Personal120.006
sshSunSSH120.006
sshBitvise WinSSHD110.005
httpRouter110.005
ftpvsftpd110.005
smtpExim smtpd100.005
openvpnOpenVPN100.005
ftpglFTPd100.005