189
Summary
- // analyst note
- legacy, niche IANA registration with no current RFC reference and no verified modern exposure or threat data; treat an unexpected open 189 with ordinary scrutiny rather than any specific documented risk.
About port 189/tcp.
Port 189/tcp is registered with IANA as qft, described as "Queued File Transport," with assignee Wayne Schroeder and a blank reference field; the registration is dual-listed for both TCP and UDP, with 189/udp carrying the identical service name, description, and assignee. The IANA registry's Registration Date, Modification Date, and Reference columns are all blank for this entry, and the same service/port pairing appears in RFC 1700, "Assigned Numbers" (October 1994), which places the assignment at least as old as that snapshot document — RFC 1700 itself is a historical enumeration of assignments rather than a per-port protocol specification, so it does not fill the registry's blank Reference field. Wayne Schroeder's public technical background points to systems-programming work at the San Diego Supercomputer Center (SDSC), suggesting qft was likely an internal or research-computing batch file-transfer utility from an HPC environment rather than a protocol with a public specification or widely distributed client/server software; no such specification or maintained implementation could be located. The nmap-services dataset does carry a measured open-frequency for this port — 189/tcp at approximately 0.000013, the dataset's lowest nonzero step — but no Shodan/Censys-style exposure counts or verified malware associations specific to port 189 were found; generic port-lookup sites carry generic "may be used by a virus" boilerplate that is not tied to any named, dated incident, so that claim is not treated as verified and is recorded here as Unknown rather than repeated as fact.
- IANA assignment
qft— "Queued File Transport"; reference blank; assignee Wayne Schroeder (registry contact detail withheld); dual-registered 189/tcp + 189/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry-465; IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Registration/modification dates
- blank in the IANA registry for this entry — Unknown, not fabricated [Confirmed absence] — the IANA Service Name and Transport Protocol Port Number Registry-465
- Prevalence / exposure scanning
- nmap-services observed open-frequency 189/tcp ≈ 0.000013 — the dataset's lowest nonzero step [Confirmed] — nmap-services dataset; sibling 189/udp ≈ 0.000461, some thirty-five times higher. Both negligible. No Shodan/Censys-style exposure count specific to port 189 was located; generic port-database "may be used by a virus" boilerplate is not tied to any named or dated incident and is not treated as verified[Unknown] — https://www.auditmypc.com/tcp-port-189.asp, https://www.speedguide.net/port.php?port=189
- Related ports
- none identified in this pass [Unknown]
Primary use
likely an internal/legacy batch file-transfer utility from an SDSC HPC research-computing environment, inferred from assignee Wayne Schroeder's systems-programming role; no public protocol spec or maintained software identified
Security implications / malware associations
Unknown — no verified malware family or CVE tied specifically to port 189 was found in this pass [Unknown]
Typically seen on
Unknown — no verified host/software population data found [Unknown]
- Historical documentation
- same qft/189 tcp+udp assignment recorded in RFC 1700 "Assigned Numbers" (October 1994), confirming the assignment predates that date; a historical snapshot, not a modern per-port RFC citation [Confirmed] — https://www.freesoft.org/CIE/RFC/1700/4.htm
- Analyst note
- legacy, niche IANA registration with no current RFC reference and no verified modern exposure or threat data; treat an unexpected open 189 with ordinary scrutiny rather than any specific documented risk.
About port 189/udp.
Port 189/udp is registered with IANA under the service name qft, described simply as "Queued File Transport," with Wayne Schroeder listed as both assignee and contact. The companion port, 189/tcp, carries the identical registration — same service name, same description, same assignee/contact — so the assignment is a dual TCP/UDP pair rather than a UDP-only entry. The registry's Reference, Registration Date, and Modification Date columns are all blank for this row: no RFC or other reference document is cited, and no dates are recorded, so those fields are reported here as genuinely unknown rather than inferred. Beyond the bare IANA registration, there is little public documentation of "Queued File Transport" as an actively used protocol; no widely deployed current software implementing it under this name was identified. Secondary port-lookup sites (SpeedGuide, tcp-udp-ports.com, ports.my-addr.com) largely just restate the IANA service name without adding verifiable detail, and a generic "malware port" scanner page (auditmypc.com) actually reports no virus/Trojan association for this port, despite templated hedge language elsewhere on the same site. One AI-generated web summary linked port 189 to the defunct 1990s PointCast Network push-content service, but this could not be corroborated against any primary source, so it is treated as unconfirmed rather than fact. On balance, port 189/udp is best understood as a System Ports (well-known range) registration that sees essentially no confirmed real-world traffic today, with no documented security incidents specific to it.
- IANA assignment
qft— "Queued File Transport"; assignee/contact Wayne Schroeder; Reference/Registration Date/Modification Date all blank in the registry [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt- Dual registration
- 189/tcp carries the identical
qft/ Queued File Transport registration (same assignee/contact, same blank Reference/dates) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry - Range class
- well-known (0–1023) [Confirmed] — port number falls below 1024 per the IANA registry's System Ports range
- IANA reference/RFC
- none listed; left blank rather than invented [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
Common software
no widely-deployed current implementation identified; an unverified AI-search mention of the defunct PointCast Network could not be corroborated against any primary source and is not treated as fact
Security implications
no confirmed CVEs, exploitation campaigns, or malware associations found; a generic scanner page in fact reports "Virus/Trojan: No" for this port, and its own boilerplate hedge text names no specific incident
Typically seen on
no reliable evidence of active real-world deployment was found; treat any observed traffic on this port as anomalous pending further evidence [Unknown]
- Primary/protocol use
- registered name suggests a queued file-transfer protocol, but no published RFC or detailed spec was found describing its wire protocol — appears to be a legacy or rarely-documented registration [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| qft | UDP | Queued File Transport | 0.05% |
| qft | TCP | Queued File Transport | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.