185
Summary
- // if you see it open
- No documented CVEs found. A 'trojan has used this port' line on a consumer port-checker site (auditmypc.com) is templated boilerplate reused across unrelated ports on the same site and shown alongside a contradictory 'no known association' verdict on the same page — not a documented incident. SANS ISC recorded sporadic, low-volume scan/background-noise traffic on the port as of 2026-07-11 (dated snapshot; threat level green, no sustained campaign).
About port 185/tcp.
Port 185/tcp is registered with IANA under the service name remote-kis, with the plain-text description "Remote-KIS" and no assignee, contact, registration date, modification date, or reference recorded in the registry — every one of those columns is blank in the IANA CSV. An identical entry exists for 185/udp (same name, same blank metadata), confirming the assignment is dual-registered rather than TCP-only. Beyond the bare registry line, no authoritative specification, RFC, or vendor document was found that defines what "KIS" stands for or describes an actual wire protocol; several generic port-lookup aggregators (t1shopper, SpeedGuide, GRC Port Authority) simply repeat the IANA name without adding verifiable detail, and none names a real, currently deployed piece of software that implements this service. SANS Internet Storm Center's live scan tracker showed sporadic low-volume background-noise probing of the port as of 2026-07-11 (a top source logging roughly 30 hits that day, down from about 100 the day before), with no sustained campaign and a "green" threat rating — a dated snapshot, not a durable fact. A malware-association line appearing on a consumer port-checker site is templated boilerplate reused across unrelated ports on that same site (it simultaneously claims and denies a trojan link for this exact port) and should not be treated as a documented incident. Given the near-total absence of first-party specification or confirmed real-world deployment, port 185 is best treated as a rarely (if ever) legitimately used, essentially undocumented IANA reservation.
- IANA assignment
remote-kis— "Remote-KIS"; reference blank; assignee blank; dual-registered 185/tcp + 185/udp [Confirmed] — local IANA registry cache (the IANA Service Name and Transport Protocol Port Number Registry, lines 456-457)- Range class
- well-known (0–1023) [Confirmed]
Primary use / protocol definition
no RFC or specification found defining an actual protocol; registry description is only the string "Remote-KIS"
Malware association
a "trojan has used this port" line on a consumer port-checker site is templated boilerplate (the same page simultaneously shows "no known trojan/virus association") — not a documented incident
- Acronym meaning ("KIS")
- could not be verified from any authoritative source in this pass [Unknown]
- Known implementations
- no currently maintained or vendor-documented software found actually implementing this service; only generic port-lookup aggregators echo the registry name [Unknown] — http://www.t1shopper.com/tools/port-number/185/, https://www.speedguide.net/port.php?port=185
- Scanning activity
- SANS ISC recorded sporadic, low-volume scan traffic as of 2026-07-11 (dated snapshot, not evergreen; threat level green) [Likely] — https://isc.sans.edu/data/port/185
About port 185/udp.
Port 185/udp is registered with IANA as remote-kis with the description "Remote-KIS," and — like its 185/tcp counterpart — carries no assignee, no registration or modification date, and a blank Reference field; nothing in the registry ties it to an RFC, so none is asserted here. "KIS" historically stands for Knowbot Information Service, a circa-1990 WHOIS-like meta-directory protocol described in RFC 1739 ("A Primer On Internet and TCP/IP Tools," December 1994): a client queried a knowbot, which fanned the request out across multiple directory databases — InterNIC, MILNET, MCImail, the PSI White Pages Pilot — and returned a consolidated "white pages" result, typically reached via telnet to research hosts or an email gateway. That RFC is useful historical context but is not the IANA-cited reference for this port, so it stays out of the reference field. No evidence suggests the Knowbot service is still operational anywhere; it reads as a defunct early-internet research tool. A separate claim, repeated across several low-quality auto-generated port-lookup sites, asserts port 185 is used for remote administration of "Kaspersky Internet Security" (also abbreviated KIS) — no authoritative Kaspersky source backs this, and it looks like a name-collision artifact rather than fact. Live SANS Internet Storm Center data shows only routine, low-volume background scan traffic on the port, a "green" threat level, and no associated CVE, consistent with generic internet noise rather than a targeted exploit against a known service.
- IANA assignment
remote-kis— "Remote-KIS"; reference (blank — no RFC cited in IANA registry); assignee blank; dual-registered 185/tcp + 185/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry rows 456–457; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=185- Range class
- well-known (0–1023) [Confirmed]
- Related ports
- 185/tcp (identical registry entry, dual registration) [Confirmed]
Security implications
no CVE tied to the port; SANS ISC shows routine low-level background scan traffic and a "green" threat level as of the observation date
Typically seen on
legacy/research hosts historically (rare); otherwise generic scanner noise on modern networks [Likely]
- Historical protocol context
- "KIS" = Knowbot Information Service, a multi-database WHOIS-like lookup tool described in RFC 1739 (Dec 1994); descriptive context only, not an IANA-cited reference for this port [Confirmed] — https://www.rfc-editor.org/rfc/rfc1739.html
- Current usage
- no confirmed mainstream software or active service uses port 185 today; the Knowbot service appears defunct [Likely] — https://www.rfc-editor.org/rfc/rfc1739.html
- Kaspersky-administration claim
- repeated on scraped port-lookup sites but unsupported by any authoritative Kaspersky source; assessed as a likely name-collision fabrication ("KIS" ambiguity) [Unknown/Unconfirmed] — no citation available to confirm
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| remote-kis | UDP | — | 0.04% |
| remote-kis | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.