Techniques for evaluating a questionable network communication are disclosed. In some implementations, an evaluation module determines whether a network communication is allowable based on one or more factors, including the listening port, a geographic location, time of day, or the like. In some cases, utilization of a listening port may be limited, such as by restricting the number of network connections that can be opened via the listening port.