Most 5 digit ports are trash. They're usually what I would call "teasers". They're infected machines that are left open to share with the public/advertise their service for the private ones that aren't open obv. You'll see this a lot with socks 5 proxies. Another reason for the 5 digits removal is for example 18186, you'll scan a good bit of those valid, but they're from China, and as such they're not useful in very many situations. I think Proxygo has said it before, and I'm not sure if he mentions if there, but if you're trying to port scan your best best is to really just stick to 2 or 3 of the most common ports and try and cover as much ground as possible. Instead of trying to scan 100,000 IPs on 10 or 15 ports, only use 3 ports and you can scan 300k-500k. You'll be much, much better doing that and trying to scan as many IPs as possible, especially in the beginning as you try to build up good blocks and ranges to scan.