Comment by jerrya

How can you ever tell that by port alone? If a box has been exploited, it's been exploited.