267
Summary
- // if you see it open
- No CVE, CISA KEV, NVD, or malware-association record specific to port 267 or Tobit David was found in this pass; reported as Unknown rather than a confirmed absence.
- // analyst note
- A responsive port 267 most plausibly indicates a Tobit David groupware deployment rather than a widely-scanned commodity service; treat unexpected occurrences as worth identifying the running software before assuming risk, since no known-malicious association exists in current sources.
About port 267/tcp.
Port 267/tcp is registered with IANA under the service name td-service, described as "Tobit David Service Layer." The registry entry is sparse: the assignee, contact, registration date, modification date, and reference (RFC) columns are all blank in both the live IANA registry page and the cached service-names-port-numbers CSV, so none of those are populated here — a blank field is reported as such rather than guessed. The same service name and description also appear on 267/udp with an identical set of blank remaining columns, indicating a genuine dual TCP/UDP registration for the one assignment rather than two independent entries. Outside the registry, vendor-community documentation for Tobit Software's David (David3/David.fx) groupware and unified-communications suite lists TCP port 267 as one of the inbound ports (alongside 443 and 8443) that a David client needs open to reach the server, which lines up with IANA's "Service Layer" description as the product's client-server communication channel. A neighboring IANA assignment, 268/tcp td-replica ("Tobit David Replica"), comes from the same vendor and is plausibly a related replication channel for the same product family, though no document ties the two together explicitly beyond shared vendor and adjacent port numbers. No CVE, CISA KEV, NVD, or malware-association record specific to port 267 or Tobit David was located in this pass, and no Shodan/Censys-style exposure count was found either. One measured figure does exist: the nmap-services dataset records 267/tcp at an observed open-frequency of approximately 0.000013 — its lowest nonzero step — with the 267/udp row at 0. Tobit David is a niche, vendor-proprietary German mid-market product, and that floor-level figure is consistent with very low real-world prevalence; the security gap remains Unknown rather than assumed.
- IANA assignment
td-service— "Tobit David Service Layer"; reference (blank — no RFC cited in registry); assignee (blank in registry); dual-registered 267/tcp + 267/udp [Confirmed] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?page=6- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 267/tcp ≈ 0.000013 — the dataset's lowest nonzero step [Confirmed] — nmap-services dataset; sibling 267/udp is 0 in the same dataset, i.e. no observed opens at all. Consistent with a niche vendor-proprietary product; no Shodan/Censys-style exposure count was located [Unknown]
- Related ports
- 268/tcp
td-servicesiblingtd-replica("Tobit David Replica"), same vendor, adjacent assignment [Confirmed registry link, Unknown functional relationship] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?page=6
Primary use
client-server communication channel for the Tobit Software David (David3/David.fx) groupware/unified-communications suite (email, fax, voicemail, groupware); vendor-community documentation lists it as a required inbound port alongside 443 and 8443 [Likely] — http://www.t1shopper.com/tools/port-number/267/, https://www.david-forum.de/thread/14850-notwendige-eingehende-ports-tcp-443-tcp-8443-und-tcp-267/
Other/unofficial uses
Unknown — no additional documented uses found this pass
Security implications
Unknown — no CVE, CISA KEV, NVD, or malware-association record specific to port 267 or Tobit David was found; absence of evidence, not a confirmed absence [Unknown]
Typically seen on
hosts running Tobit Software David/David.fx groupware servers or clients
- Analyst note
- A responsive port 267 most plausibly indicates a Tobit David groupware deployment rather than a widely-scanned commodity service; treat unexpected occurrences as worth identifying the running software before assuming risk, since no known-malicious association exists in current sources.
About port 267/udp.
Port 267/udp is registered with IANA as td-service, described as "Tobit David Service Layer," with blank assignee, contact, and reference fields; the identical entry also exists for 267/tcp, so the assignment is dual-registered across both transports rather than udp-specific. No RFC or other document backs the reference field, and none should be invented for it. Outside the registry, three independent vendor/support sources (a David administration wiki, a German-language reseller FAQ, and an IT-services blog) converge on the same real-world context: this is the client-connection port for the "Service Layer" of Tobit David — also historically marketed as Tobit FaxWare or David FaxWare — an on-premises German groupware, messaging, and fax server product from Tobit.Software (Ahaus, Germany). The David desktop/mobile client uses port 267 (configurable, TCP or UDP) to reach the server's Service Layer, while the adjacent port 268 is used separately for server-to-server replication (REPLIKA) between David installations. No mainstream general-purpose software besides Tobit David is documented as using this port, and this research pass turned up no CVE, malware/trojan association, or internet-scan-prevalence data implicating 267 — it reads as a low-profile, vendor-niche assignment rather than a commonly targeted one, which is itself a useful, honestly-null data point for an analyst rather than a gap to paper over.
- IANA assignment
td-service— "Tobit David Service Layer"; reference field blank; assignee/contact blank; dual-registered 267/tcp + 267/udp with identical, otherwise-blank rows [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (udp row), :597 (tcp counterpart); corroborated live at IANA's registry page- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no nmap-services or comparable scan-frequency data found for this port [Unknown]
Primary use
client-to-server connection port for the "Service Layer" of Tobit David / David FaxWare, an on-premises groupware/messaging/fax server product from Tobit.Software (Ahaus, Germany) [Likely] — http://david-wiki.andev.de/ports, https://faq.kapa.de/content/6/372/de/welche-tcp_ip_ports-nutzt-tobit-david.html, https://www.fleutec.de/tobit-david-tcpip-ports/
Other/unofficial uses
none documented beyond Tobit David software in the sources checked [Unknown]
Security implications
no CVE, malware/trojan default-port association, or internet-mass-scan prevalence data found in this pass; appears to be a low-profile vendor-specific port rather than a commonly-targeted one (AbuseIPDB/Shodan InternetDB not queried — project-prohibited licensing) [Unknown]
Typically seen on
legacy/on-premises Tobit David (David FaxWare) enterprise groupware servers, primarily in German-speaking business environments [Likely]
- Related port 268
- used separately for server-to-server replication (REPLIKA) between David servers [Likely] — same three sources
- Analyst note
- an open 267 (especially paired with 268) is a fairly specific signature for a Tobit David/David FaxWare deployment rather than a generic service; given the blank IANA reference and vendor-niche profile, treat unexpected exposure as worth identifying the product rather than assuming malicious intent.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| td-service | TCP | Tobit David Service Layer | 0.00% |
| td-service | UDP | Tobit David Service Layer | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.