Colleague suggested it. No idea why he thought it might be open, but it was enough for the test. The point was to find a port that was likely open, and a standard port is much more likely open than 4005.

We tried to use 80 and temporarily disable the plc webserver, but alas Siemens won’t actually disable the webserver and allow use of the port.