Internet-Security.com TCP port 85 details

IANA assigns TCP port 85 to the MIT-ML-DEVICE protocol, a historic MIT AI Lab service that is rarely seen today.
In practice, many low-cost DVRs/IP cameras built on Xiongmai (XMeye/NetSurveillance) firmware run their embedded web interface (typically GoAhead or uc-httpd) on TCP/85; large numbers of such devices are visible on Internet scans (e.g., Shodan).
Numerous vendor guides and field deployments of consumer DVRs/cameras use TCP/85 for the HTTP admin page (often as an alternative to port 80), especially across rebranded “H.264 DVR” devices based on the Xiongmai stack.
Security note: IoT botnets such as Mirai/Gafgyt variants routinely scan and exploit TCP/85 on these DVR/camera web interfaces due to default credentials and known web vulnerabilities in the embedded servers.

TCP 85