141
Summary
- // if you see it open
- No confirmed malware/trojan association. Secondary port-lookup sites (AuditMyPC, SpeedGuide) list port 141 with generic boilerplate disclaimer language ('a Trojan or Virus has used this port in the past to communicate') applied broadly across many ports and naming no specific malware family, sample, or dated incident — not verifiable as a genuine, port-specific threat.
- // analyst note
- treat 141/tcp as an obscure, sparsely-documented legacy IANA registration; a responsive port 141 in a live scan should not be assumed to be genuine EMFIS Control Service traffic without further investigation.
About port 141/tcp.
Port 141/tcp is registered with IANA as emfis-cntl, described as "EMFIS Control Service," with Gerd Beling listed as the assignee and contact and a blank Reference field — meaning no RFC or other formal specification is cited for this assignment. The entry is dual-registered on TCP and UDP (141/udp carries the identical service name and description), and IANA publishes no registration or modification date for it, consistent with many older, sparsely-documented registrations rather than an oversight worth flagging as anomalous. Beyond the bare registry label, verifiable information is scarce: no vendor documentation, product page, or open-source implementation naming "EMFIS Control Service" was located, so the actual software this port was reserved for — apparently tied to a market-information or statistical system referenced by the "EMFIS" name — cannot be confirmed. Generic port-lookup aggregators (AuditMyPC, SpeedGuide) include port 141 in boilerplate disclaimer language claiming Trojans or viruses have used the port historically, but this phrasing is applied indiscriminately across large swaths of the port range and names no specific malware family, sample, or dated incident, so it should not be recorded as a genuine, attributable threat association. In practice, port 141 has essentially no confirmed modern footprint: it is not associated with any actively maintained service, the nmap-services dataset puts its observed open-frequency at approximately 0.000013 — the dataset's lowest nonzero step — and any observed traffic on it in a live environment should be treated as unidentified/anomalous rather than assumed to be legitimate EMFIS Control Service traffic, pending further investigation.
- IANA assignment
emfis-cntl— "EMFIS Control Service"; reference (blank — no RFC cited in IANA registry); assignee/contact Gerd_Beling; dual-registered 141/tcp + 141/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt)- Range class
- well-known (0–1023) [Confirmed]
- Registration/modification date
- blank in the IANA registry — not published for this entry [Unknown] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
- Prevalence
- nmap-services observed open-frequency 141/tcp ≈ 0.000013 — the dataset's lowest nonzero step [Confirmed] — nmap-services dataset; sibling 141/udp ≈ 0.000428, some thirty-three times higher. Both negligible; consistent with a legacy assignment with no live footprint
- Related ports
- none identified in this cycle
Primary use
no vendor documentation, product page, or software confirmed to implement "EMFIS Control Service"; appears to be a legacy/niche assignment with negligible current-day footprint [Unknown]
Other/unofficial uses
none confirmed [Unknown]
Security implications
AuditMyPC and SpeedGuide list port 141 with generic disclaimer language ("a Trojan or Virus has used this port in the past to communicate") applied broadly across many ports, naming no specific malware family, sample, or dated incident — not verifiable as a genuine, port-specific threat association
Typically seen on
Unknown — no confirmed deployments identified
- Analyst note
- treat 141/tcp as an obscure, sparsely-documented legacy IANA registration; a responsive port 141 in a live scan should not be assumed to be genuine EMFIS Control Service traffic without further investigation.
About port 141/udp.
Port 141/udp is registered with IANA under the service name emfis-cntl, described as "EMFIS Control Service," with assignee and contact both listed as [Gerd_Beling]. The registry's Registration Date, Modification Date, and Reference columns are all blank for this entry, and the identical service name and description are also registered on 141/tcp — a dual TCP/UDP registration pattern common among legacy System Port assignments. By naming convention this control channel almost certainly pairs with port 140/udp (emfis-data), the parallel data-transfer registration for the same EMFIS system, though the registry entry itself does not spell out that relationship. EMFIS ("Extended Mainframe Information System") was a database and statistics package used in West German academic and research mainframe computing during the 1980s and into the early 1990s; no RFC or other public protocol specification was ever published, and no surviving documentation of its wire format was located. No current software, appliance, or vendor product was found using port 141 for any purpose, and no CVE, malware family, or botnet has been publicly associated with it. Because the service predates the modern internet and left no protocol documentation or active deployment footprint, an open 141/udp today is best treated as a curiosity — most plausibly background internet scan noise rather than a genuine emfis-cntl listener — the nmap-services dataset records an open-frequency of about 0.000428 for 141/udp (roughly 4 in 10,000 scanned hosts), and beyond that figure this pass found no scan-telemetry source (Shodan, GreyNoise, SANS ISC/DShield) quantifying the traffic specifically.
- IANA assignment
emfis-cntl— "EMFIS Control Service"; reference (blank — no RFC cited in IANA registry); assignee/contact [Gerd_Beling]; dual-registered 141/tcp + 141/udp with identical name/description [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)- Range class
- well-known (0–1023) [Confirmed] — port number falls in the 0–1023 IANA System Ports range
- Prevalence
- nmap-services observed open-frequency 141/udp ≈ 0.000428 (very low — roughly 4 in 10,000 scanned hosts in the nmap-services sample); the dual-registered 141/tcp side is rarer still at ≈ 0.000013 [Confirmed] — nmap-services dataset; beyond that figure no scan/exposure telemetry source (Shodan, GreyNoise, SANS ISC/DShield) with port-141-specific data was found in this pass [Unknown]
- Related ports
- 140/udp (
emfis-data) — the companion data-channel registration inferred from the matching "emfis-*" naming, though the registry entry for 141 itself does not state the pairing explicitly [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Primary use
legacy EMFIS control channel; EMFIS was a mainframe database/statistics system used in West German academic and research computing circa the 1980s–early 1990s; no public protocol spec or RFC was ever published [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml, https://www.speedguide.net/port.php?port=141
Other/unofficial uses
none identified — no modern (2020s-era) software, appliance, or vendor product was found using this port [Likely] — https://www.speedguide.net/port.php?port=141, https://www.grc.com/port_141.htm, https://www.auditmypc.com/udp-port-141.asp
Security implications
no CVE, malware family, or botnet publicly associated with port 141 or "emfis" was found; negligible modern relevance given the service is a defunct legacy system with no deployment footprint located
Typically seen on
none identified in modern deployments; historically tied to legacy EMFIS mainframe installations
- Analyst note
- An open 141/udp today has no known legitimate modern use; treat any observed traffic as most likely background internet scan noise or misconfiguration rather than a genuine emfis-cntl service, pending better scan-telemetry data.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| emfis-cntl | UDP | EMFIS Control Service | 0.04% |
| emfis-cntl | TCP | EMFIS Control Service | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.