26
Summary
- // if you see it open
- SANS ISC documented a 26/tcp traffic spike beginning ~the second week of November 2019; honeypot data showed predominantly telnet-style brute-force password attempts consistent with Mirai-botnet patterns, with only isolated SMTP/SSH probes. Ongoing low-level scanning is tracked by SANS ISC. The port is unassigned and carries no built-in authentication, so exposing any service on it without TLS and authentication controls (as port 587 mandates) is inadvisable.
- // analyst note
- Port 26 is IANA-Unassigned — there is no standard service. Treat a responsive port 26 as either an alternate-SMTP relay (common in shared hosting) or an exposed telnet/brute-force target, and verify TLS + authentication on any mail service placed here.
About port 26/tcp.
Port 26/tcp is listed as Unassigned in the IANA Service Name and Transport Protocol Port Number Registry — there is no registered service name, no assignee, no RFC reference, and no registration or modification date, and the same is true of 26/udp (both rows read "Unassigned"). Because the slot is unassigned at IANA, anything observed on it is operational convention rather than a standard. In practice port 26 has settled into one dominant role: an informal alternate SMTP submission port used chiefly by shared-hosting control panels — notably cPanel/WHM running Exim, and Proxmox Mail Gateway — when an ISP or upstream provider blocks the well-known mail ports. Unlike port 587, the IANA-registered Message Submission port defined in RFC 6409/RFC 4409, port 26 carries no RFC backing and no protocol-mandated authentication or TLS; using it for mail is purely a workaround for blocked egress. For an analyst the security-relevant context is that the port also draws opportunistic scanning: SANS ISC documented a traffic spike on 26/tcp beginning around the second week of November 2019, where honeypot data showed predominantly telnet-style brute-force password attempts consistent with Mirai-botnet patterns, with only isolated genuine SMTP or SSH probes — i.e. scanners appear to treat it as both a possible embedded-device telnet alternative and a mail-relay substitute. Low-level scanning of the port is tracked on an ongoing basis by SANS ISC. The practical takeaway: because the slot is unassigned and any service on it inherits none of port 587's mandated authentication and TLS, a responsive port 26 is worth identifying as either an alternate-SMTP relay (common in shared hosting) or an exposed telnet/brute-force target, and any mail service placed there should still enforce TLS and authentication explicitly.
- IANA assignment
- Unassigned — no service name, assignee, reference, registration date, or modification date; 26/udp is likewise Unassigned (dual rows both blank) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry)
- Range class
- well-known (0–1023)
- Related ports
- 25 (SMTP), 587 (submission/RFC 6409), 465 (SMTPS); 2525 (another informal alternate SMTP port)
Primary use
informal alternate SMTP submission port, used when port 25 is blocked by an ISP/upstream; no RFC backing (contrast port 587, the registered submission port per RFC 6409)
Common software
Exim via cPanel/WHM; Proxmox Mail Gateway
Other/unofficial uses
opportunistic-scan target treated as a possible embedded-device telnet alternative (Mirai-pattern brute force) in addition to a mail-relay substitute
Security implications
SANS ISC observed a 26/tcp spike from ~the second week of November 2019; honeypot data was predominantly telnet-style brute-force (Mirai-attributed) with only isolated SMTP/SSH probes; an unassigned port carries no built-in auth, so any service exposed without TLS + authentication (as 587 mandates) is inadvisable
Typically seen on
shared-hosting mail servers (cPanel/WHM Exim, Proxmox Mail Gateway) where port 25 egress is blocked; otherwise an opportunistic-scan magnet
- Risk level
- low-to-moderate — SANS ISC threat level green at last check, but Mirai-pattern scanning is persistent; main risk is an unsecured SMTP relay or telnet service exposed here [Likely] — SANS ISC port 26 data
- Analyst note
- Port 26 is IANA-Unassigned — there is no standard service. Treat a responsive port 26 as either an alternate-SMTP relay (common in shared hosting) or an exposed telnet/brute-force target, and verify TLS + authentication on any mail service placed here.
About port 26/udp.
Port 26/udp is Unassigned in the IANA Service Names and Transport Protocol Port Number Registry: the row carries a blank service name, the literal description "Unassigned," no assignee or contact, no registration or modification dates, and a blank reference field. Port 26/tcp is identically Unassigned, so there is no registered service on either transport. With no IANA assignment to anchor it, anything seen on port 26 is a de-facto convention rather than a standard. The well-known de-facto use lives entirely on the TCP side: port 26/tcp is a common alternate SMTP port — Proxmox Mail Gateway uses 26 by default for outgoing message routing, and various mail transfer agents fall back to it when port 25 is blocked or contended. That convention does not carry over to UDP, because SMTP is a TCP protocol and does not run over UDP; consequently there is no documented legitimate UDP protocol on port 26. What activity exists is security-relevant: SANS ISC recorded a pronounced scanning spike against port 26 beginning around September 2019 (briefly ranking it among the top ports), with honeypots capturing mostly telnet-style probes rather than SMTP, and the port 26 (TCP) number has been used for command-and-control by the BadPatch malware family (Elastic prebuilt detection; MITRE ATT&CK techniques T1071.003 / T1571 / T1048). Those observations are TCP-side; no UDP-specific scanning campaign or malware targeting 26/udp is documented in available sources. There is also an informal legacy association of port 26 with "AltaVista Firewall 97" noted by SpeedGuide/SANS references, but that is folklore, not an IANA assignment. For an analyst, traffic on 26/udp has no sanctioned purpose: treat it as unexpected and investigate it as scanning, spoofed-source noise, or a non-standard application rather than a recognised service.
- IANA assignment
- none — service name blank; description "Unassigned"; reference blank (no RFC cited); no assignee, contact, or dates; dual-status with 26/tcp (also Unassigned) [Confirmed] — IANA Service Names and Port Numbers registry (cached CSV line 60 for udp, line 59 for tcp); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
- Range class
- well-known (0–1023)
- Related ports
- 25/tcp (SMTP, the standard mail port that 26/tcp substitutes for); 28/udp (next Unassigned UDP port)
Primary use (udp)
none documented — port 26 is officially unassigned, and the well-known alternate-SMTP convention is TCP-only (SMTP does not run over UDP)
Other/unofficial uses
on TCP, alternate SMTP port — Proxmox Mail Gateway default for outgoing routing; MTA fallback when 25 is blocked. No UDP software documented on port 26.
Security implications
TCP port 26 used for C2 by the BadPatch malware family (MITRE ATT&CK T1071.003 / T1571 / T1048); SANS ISC observed a scanning spike from ~Sep 2019 (mostly telnet-style probes, not SMTP). No UDP-specific attack or scanning campaign on port 26 documented. [Confirmed/Threat-reported] — https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/network/command_and_control_port_26_activity, https://isc.sans.edu/diary/25564
Exposure / scanning
SANS ISC tracks active scanning against port 26 (ranked ~#5 in their dashboard in late 2019); scanning is predominantly TCP-side, with no UDP-specific data for port 26 in available sources.
Typically seen on
nothing sanctioned — unexpected on UDP; investigate as scanning, spoofed noise, or a non-standard app
- Historical context
- informal legacy association with "AltaVista Firewall 97" (SpeedGuide/SANS references); not an IANA assignment, port remains unassigned. [Likely] — https://isc.sans.edu/data/port/26
- Analyst note
- There is no legitimate UDP service on port 26. The familiar "alternate SMTP" role is TCP-only; treat any 26/udp traffic as anomalous.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| rsftp | TCP | — | 0.80% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.