262
Summary
- // if you see it open
- No trojan/malware association found in the trojan-port references checked. The near-total absence of public documentation of any real-world service makes it plausible that unsolicited 262/tcp|udp traffic today is background/opportunistic scanning rather than a recognized legitimate service — an inference from the documentation gap, corroborated by the minute nmap-services open-frequency (~0.000038 tcp, ~0.000577 udp) though not by per-host scan telemetry.
- // analyst note
- a research pass initially misattributed port 262 to QMTP (Quick Mail Transfer Protocol) via a plain-text registry mirror; this was disproved by cross-checking the IANA CSV directly — QMTP is actually registered on port 209, not 262. Port 262's only IANA registration is
arcisdms; the QMTP association does not apply here [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv, https://whatportis.com/ports/209_the-quick-mail-transfer-protocol
About port 262/tcp.
Port 262/tcp is registered with IANA under the service name arcisdms, with the bare description "Arcisdms," assignee and contact both listed as Russell Crook. The assignment is dual-registered: an identical row exists for 262/udp, differing only in the protocol column. Beyond that thin registry entry, IANA's own data is sparse in a way worth noting explicitly — the registration-date, modification-date, and reference fields for this row are blank in the source registry itself, which is a genuine gap in IANA's published record rather than something omitted during research. No RFC, protocol specification, vendor manual, or product documentation describing what Arcisdms actually is, what software implements it, or what data it carries turned up in a web search pass. The handful of secondary port-lookup sites that list port 262 (SpeedGuide, GRC's Port Authority, t1shopper, and similar mirrors) all reproduce the same bare IANA service-name/description pair without adding independent detail, so they function as downstream copies of the registry rather than corroborating sources. No trojan or malware association for port 262 appears in the trojan-port compilations checked. Given the combination of a real IANA assignment and an almost total absence of documented real-world usage, an analyst encountering traffic on 262/tcp or 262/udp today should treat it as more likely to reflect opportunistic background scanning than a recognized, actively deployed service — a read grounded in the documentation gap and corroborated by measurement: the nmap-services dataset records an observed open-frequency of about 0.000038 for 262/tcp, roughly 4 in 100,000 scanned hosts, against about 0.000577 on the UDP side.
- IANA assignment
arcisdms— description "Arcisdms"; reference (blank — no RFC cited in IANA registry); assignee/contact Russell Crook; dual-registered 262/tcp + 262/udp (identical rows apart from protocol) [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)- Range class
- well-known (0–1023)
- Registration/modification dates
- blank in IANA's own registry for this row — a gap in IANA's published data, not an inference or omission [Confirmed] — IANA registry CSV
- Prevalence
- nmap-services observed open-frequency 262/tcp ≈ 0.000038 (very low — roughly 4 in 100,000 scanned hosts in the nmap-services sample); the dual-registered 262/udp side is higher at ≈ 0.000577 [Confirmed] — nmap-services dataset. The figure records scan-observed openness on the port number, not confirmed arcisdms use [Confirmed]
- Related ports
- none specifically documented
Primary use
Unknown — no RFC, protocol spec, or vendor/product documentation describing Arcisdms could be located; only the bare IANA label exists [Unknown] — checked against https://www.grc.com/port_262.htm, https://www.speedguide.net/port.php?port=262, http://www.t1shopper.com/tools/port-number/262/ (all mirror the same thin IANA row with no added detail)
Other/unofficial uses
none documented [Unknown]
Security implications
no trojan/malware association found in the trojan-port references checked
Typically seen on
no known legitimate deployments documented; unsolicited traffic is plausibly background/opportunistic internet scanning given the near-total absence of documented usage — an informed inference, corroborated by the minute nmap-services open-frequency (≈ 0.000038) but not by any per-host scan telemetry
- Analyst note
- a research pass initially misattributed port 262 to QMTP (Quick Mail Transfer Protocol) via a plain-text registry mirror; this was disproved by cross-checking the IANA CSV directly — QMTP is actually registered on port 209, not 262. Port 262's only IANA registration is
arcisdms; the QMTP association does not apply here [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv, https://whatportis.com/ports/209_the-quick-mail-transfer-protocol
About port 262/udp.
Port 262/udp is registered with IANA under the service name arcisdms, description simply "Arcisdms," with assignee and contact listed as [Russell_Crook]. The assignment is dual-registered: an identical entry exists for 262/tcp, sharing the same service name, description, and contact, and both entries leave the Registration Date, Modification Date, and Reference (RFC) fields blank in IANA's own data — a genuine gap in the registry rather than an omission on our part. Neither the cached registry CSV nor a live pull of the current IANA registry adds any further detail, and no protocol specification, software product, or documented service implementing an "arcisdms" name turned up in secondary research: Wikipedia's List of TCP and UDP port numbers and GRC's Port Authority page both simply restate the bare IANA registration without elaboration. No credible, source-backed malware or CVE association exists for this port; the aggregator site AuditMyPC carries generic templated warning language about historical Trojan or virus activity that appears to be boilerplate repeated across many of its port pages rather than tied to a specific incident, and the port does not appear in the reputable suspicious-port reference lists checked. Because the underlying service is effectively undocumented, an analyst encountering live traffic on 262/udp should treat it as an unidentified or anomalous service rather than assume either legitimate use or compromise — there simply isn't enough public information available to characterize what, if anything, commonly runs there.
- IANA assignment
- service name
arcisdms, description "Arcisdms," assignee/contact [Russell_Crook], Registration Date/Modification Date/Reference all blank in the registry; dual-registered 262/tcp + 262/udp with identical data [Confirmed] — cached registry CSV cross-checked against a live pull of https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv - Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 262/udp ≈ 0.000577 (very low — roughly 6 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 262/tcp side is far rarer at ≈ 0.000038 [Confirmed] — nmap-services dataset
- Related ports
- 262/tcp (dual-registered sibling, identical service name, description, contact, and blank reference) [Confirmed] — IANA registry CSV
Primary use
Unknown — no software, protocol specification, or expansion of the "arcisdms" name identified in registry data or web research
Other/unofficial uses
none identified [Unknown]
Security implications
no specific, source-backed malware or CVE association found; AuditMyPC displays generic templated Trojan/virus warning language common across many of its port pages, not tied to a documented incident; port absent from the reputable suspicious-port lists checked (Gary Kessler bad-ports list, mthcht/suspicious-ports)
Typically seen on
Unknown — no documented deployments identified
- Analyst note
- an essentially undocumented registered assignment; treat live 262/udp traffic as unidentified/anomalous rather than assuming legitimate use or compromise, since no software or protocol behind "arcisdms" could be established.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| arcisdms | UDP | — | 0.06% |
| arcisdms | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.