181
Summary
- // if you see it open
- No CVEs or corroborated malware campaigns were found tied to port 181. A generic 'historically used by a trojan' claim on a single low-authority port-lookup aggregator (auditmypc.com) is unverified boilerplate, not independently corroborated, and is not reported as a sourced security finding.
About port 181/tcp.
Port 181/tcp is registered with IANA under the service name unify, with the description field reading simply "Unify," and both the assignee and contact fields pointing to Daegis, Inc. and Chris Anderson respectively. The registration-date column is blank in the current registry, while the modification-date column reads 2012-07-31; that date most plausibly reflects an administrative update to the assignee/contact record rather than the port's original assignment, since Daegis, Inc. did not exist under that name until Unify Corporation was rebranded around 2011 (Daegis was later acquired by OpenText in 2015) — third-party port listings already carry the "unify" service name for port 181 as far back as 1999, well before the Daegis rename, so the true original allocation date is unknown rather than 2012. The assignment is dual-registered, with 181/udp carrying an identical service name, description, assignee, contact, and modification date. No RFC or other document is cited in the IANA Reference column, so none is invented here. Unify Corporation historically sold relational-database and application-development tooling, and port 181 is presumed tied to that product line, though no vendor documentation was located confirming an active current binding. No CVEs or corroborated malware campaigns were found tied to this port; a generic "historically used by a trojan" claim on a single low-authority aggregator site is unverified boilerplate, not a sourced security finding.
- IANA assignment
unify— description "Unify"; assignee [Daegis_Inc]; contact [Chris_Anderson]; reference blank; dual-registered 181/tcp + 181/udp with identical fields [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml ; the IANA Service Name and Transport Protocol Port Number Registry-449- Range class
- well-known (0–1023) [Confirmed]
- Registration date
- blank in the IANA registry — not fabricated, reported as Unknown [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
- Modification date
- 2012-07-31 per the current IANA record, but this most likely reflects the Unify→Daegis corporate-rename/contact update rather than the port's original assignment; true original allocation date is Unknown [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml ; https://en.wikipedia.org/wiki/Daegis_Inc.
- Prevalence (open-port frequency)
- the nmap-services dataset records
unifyon 181/tcp with an open-frequency of 0.000025 — about 0.0025% of sampled hosts, two steps above the dataset's nonzero floor; the 181/udp sibling is higher at 0.000181 [Confirmed] — nmap-services dataset - Related ports
- 181/udp — the same
unifyregistration, dual-registered by IANA with an identical description ("Unify"), assignee [Daegis_Inc], contact [Chris_Anderson] and 2012-07-31 modification date; a service-name and assignee search of the cached registry returns these two rows and no others, so 181/udp is the only port related to this one by registration[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry unify 181/udp
Security implications
no CVEs found tied to this port; a "historically used by a trojan" claim appears only on a single low-authority aggregator (auditmypc.com) with no primary-source corroboration, treated as unverified
Typically seen on
legacy Unify/Daegis database or application-development deployments, if seen at all; otherwise anomalous [Likely]
- Assignee history
- Daegis, Inc., formerly Unify Corporation (renamed ~2011), acquired by OpenText in 2015 [Likely] — https://en.wikipedia.org/wiki/Daegis_Inc.
- Primary/historical use
- presumed tied to Unify Corporation's relational-database/application-development tooling; no vendor documentation found confirming an active modern binding [Unknown]
About port 181/udp.
Port 181/udp is registered with IANA under the service name unify, described simply as "Unify," with assignee Daegis, Inc. and contact Chris Anderson (IANA registry entry, modification date 2012-07-31; no registration date and no RFC/reference recorded). The 181/tcp assignment carries an identical record — same service name, same assignee, same modification date — making this a dual TCP/UDP name reservation rather than two independently defined protocols. The "Unify" name traces to Unify Corporation, a relational-database vendor founded in 1980 in Irving, Texas, best known for the UNIFY RDBMS; the company was rebranded/merged into Daegis Inc., an eDiscovery software firm, around 2010–2011, and Daegis was later acquired by OpenText in 2015. No publicly documented wire protocol specification for 181/udp was located beyond the bare IANA name reservation, and no CVE, malware family, or credible scanning campaign tied specifically to this port surfaced in research. One low-reliability automated port-lookup aggregator carries generic malware-risk boilerplate text but its own live verdict for the port reads "no," making it self-contradictory and unsuitable as a security source. For an analyst, port 181/udp should be treated as a rarely-seen legacy corporate registration with no known modern protocol behavior or exploitation history worth flagging on its own.
- IANA assignment
unify— "Unify"; reference (blank — no RFC cited in IANA registry); assignee Daegis, Inc. (contact Chris Anderson); modification date 2012-07-31; no registration date recorded [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence (open-port frequency)
- nmap-services observed open-frequency 181/udp ≈ 0.000181 — very low (roughly 2 in 10,000 scanned hosts in the nmap-services sample); the paired 181/tcp row is rarer still at ≈ 0.000025 [Confirmed] — nmap-services dataset
- Related ports
- 181/tcp (dual-registered
unify, identical IANA record)
Typically seen on
Unknown — no evidence of active contemporary software listening on 181/udp
Security implications
no CVE, named malware family, or documented scanning campaign found tied specifically to 181/udp; one low-reliability aggregator (auditmypc.com) carries generic "used by malware historically" boilerplate but its own live per-port verdict reads "no," so it is cited for transparency only, not as a substantiated finding
- TCP dual-registration
- 181/tcp is also registered as
unifywith an identical record (same assignee, contact, and modification date) [Confirmed] — IANA registry - Corporate lineage / naming origin
- Unify Corporation (est. 1980, Irving, TX; maker of the UNIFY relational database) rebranded/merged into Daegis Inc. (eDiscovery software) circa 2010–2011; Daegis was acquired by OpenText in 2015 [Likely] — Wikipedia, BusinessWire press release
- Documented wire protocol
- none found beyond the bare IANA name reservation [Unknown] — no authoritative spec located
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| unify | UDP | — | 0.02% |
| unify | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.