180

Port 180/tcp is registered with IANA under the service name ris, with the description "Intergraph" and assignee/contact listed as [Dave_Buehmann]. The registry lists no RFC or IANA reference, and both the Registration Date and Modification Date fields are blank — consistent with a pre-RFC-era IANA assignment rather than one backed by a documented protocol specification. Port 180/udp carries an identical entry (same service name, description, and assignee), so this is a dual-registered assignment rather than a TCP-specific service. IANA's terse "Intergraph" description does not spell out what "ris" stands for, and a secondary claim circulating online that it expands to "Remote Installation Services" was not corroborated by any primary source — that phrase is actually a distinct Microsoft feature name unrelated to Intergraph, so it is treated here as unverified rather than recorded as fact. No mainstream server or client software was found to default to port 180 today; several low-quality port-lookup mirror sites (SpeedGuide, AuditMyPC) simply restate the IANA registry entry without adding verifiable detail or documenting a malware association. SANS Internet Storm Center's scanning telemetry for the port showed low, non-targeted internet background-noise scanning as of the check date, with no associated CVE and no user-submitted reports. Practically, an unexpected listener on 180/tcp should be treated as anomalous and investigated rather than assumed to be a known-safe or known-malicious service, since there is no documented mainstream deployment using this port today.

IANA assignment

ris — "Intergraph"; reference (blank — no RFC cited in IANA registry); assignee/contact [Dave_Buehmann]; dual-registered 180/tcp + 180/udp identically [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)

Registration/Modification dates

blank in the IANA registry for this entry — recorded as null, not fabricated [Confirmed] — IANA registry

Range class

well-known (0–1023) [Confirmed]

Related ports

none specifically documented by IANA alongside this entry; not asserting a cluster without a source [Unknown]

Common software

none identified; mirror/database sites (SpeedGuide, AuditMyPC) only echo the IANA entry without added detail

Security implications

no confirmed malware/trojan association found; low but non-zero internet-wide background scanning observed, no associated CVE

Typically seen on

no current mainstream deployment identified; an open port 180 today is unusual and worth investigating [Unknown/Likely]

Expansion of "ris"

Unknown — IANA gives only the company name "Intergraph," not a spelled-out protocol name; the "Remote Installation Services" gloss seen on some sites is an unrelated Microsoft feature name and is not corroborated [Unknown]

Primary/current use

no publicly documented protocol specification, client, or server software was found actively using port 180 today; historically tied to an internal Intergraph (GIS/CAD/public-safety dispatch vendor) service [Likely] — IANA registry

Port 180/udp is registered with IANA under the service name ris, description "Intergraph," with assignee and contact both listed as Dave Buehmann. The entry is dual-registered: 180/tcp carries the identical service name, description, and assignee/contact, and both the tcp and udp rows leave Registration Date, Modification Date, and Reference blank in the IANA Service Name and Transport Protocol Port Number Registry — there is no RFC or other technical specification on file for this assignment, on either transport. Because IANA itself publishes no protocol definition, what "ris" actually does is not authoritatively documented; a third-party port-reference site glosses the name as "Remote Image Service" tied to Intergraph software, but that expansion does not appear in any IANA or Intergraph primary source located during this research pass, so it is carried here as an unconfirmed, single-source claim rather than fact. Intergraph itself has since been absorbed through multiple acquisitions into Hexagon AB, and no current, live product documentation referencing UDP port 180 was found. The nmap-services dataset measures an observed open-frequency of roughly 0.000478 for 180/udp and 0.000038 for 180/tcp, and beyond that figure no Shodan/Censys banner statistics, malware associations, or CVEs specific to this port turned up, which is unsurprising for a low-traffic, decades-old registry entry outside the well-known "famous" port set. In the absence of confirmed active usage, any observed traffic on 180/udp is more plausibly attributable to routine internet-wide background port-scanning sweeping the full port range than to a live, dedicated "ris" service, though that is an inference rather than a sourced finding for this specific port.

IANA assignment

ris — "Intergraph"; Registration Date, Modification Date, and Reference all blank in the registry; assignee/contact [Dave_Buehmann]; dual-registered 180/tcp + 180/udp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt (corroborated independently by the cached registry CSV, the IANA Service Name and Transport Protocol Port Number Registry, lines 446-447)

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services observed open-frequency 180/udp ≈ 0.000478 (very low — roughly 5 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 180/tcp side is far rarer at ≈ 0.000038 [Confirmed] — nmap-services dataset

Related ports

180/tcp (identical dual registration, same assignee/description) [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

Primary use

no protocol specification or RFC is published by IANA for "ris"; a third-party site (t1shopper) glosses it as an Intergraph "Remote Image Service," but this expansion is not corroborated by any IANA or Intergraph primary source

Other/unofficial uses

Unknown — no current software, product, or vendor documentation actively using UDP/180 was located; Intergraph has since been absorbed into Hexagon AB with no live reference to this port [Unknown]

Security implications

Unknown — no CVEs, malware associations, or Shodan/Censys banner data specific to UDP/180 were found; any observed traffic is more plausibly routine internet-wide background scanning than a live dedicated service, but this is an inference, not a sourced finding [Unknown]

Typically seen on

Unknown — no evidence of active deployment found [Unknown]

Analyst note

Treat an open/responsive 180/udp as anomalous given the lack of any confirmed live usage; investigate rather than assume routine service traffic.