281
Summary
- // if you see it open
- No CVEs, malware, or C2 activity specifically associated with port 281 were identified in this research pass. Real-world exposure appears negligible per nmap scan-frequency data; an unexpected open port 281 would be statistically unusual.
- // analyst note
- an open port 281 would be unusual given its near-zero scan prevalence; treat as an anomaly worth individual investigation rather than a known signature, since no malware or CVE association exists.
About port 281/tcp.
Port 281 is registered with IANA under the service name personal-link, description "Personal Link," with assignee/contact Dan Cummings on file; the registration is dual — both 281/tcp and 281/udp appear as separate rows in the IANA Service Name and Transport Protocol Port Number Registry. No RFC or other reference document is listed for this entry, and the registry's public CSV/XHTML export exposes no registration or modification date for it, so both fields are left blank rather than guessed. Beyond the bare name and description, IANA documents no protocol specification for "Personal Link," and no specific software product, vendor, or open-source project could be confirmed as implementing it in this research pass — port-list aggregator sites merely restate the same IANA registration without adding attribution, and one aggregator's own page was unreachable (HTTP 403) during the check. Empirical scan-frequency data from nmap's nmap-services file shows 281/tcp at a frequency of 0.000000 and 281/udp at 0.000544, indicating the port is essentially never observed open in real-world scans. No CVEs, malware, or trojan associations tied specifically to port 281 were found, so real-world exposure and threat relevance both appear negligible; an unexpected open 281 would be unusual and worth investigating on its own merits rather than as a known-bad signature.
- IANA assignment
personal-link— "Personal Link"; reference (blank — no RFC cited in IANA registry); assignee/contact [Dan_Cummings]; dual-registered 281/tcp + 281/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV, lines 610-611; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml)- Range class
- well-known (0–1023)
- Registration/modification dates
- Unknown — blank in the cached IANA CSV export and not exposed by the public registry page; not fabricated [Confirmed] — same registry sources above
- Prevalence
- nmap-services open-frequency 281/tcp ≈ 0.000000, 281/udp ≈ 0.000544 — essentially never observed open [Likely] — https://svn.nmap.org/nmap/nmap-services
- Related ports
- none specifically identified in this pass
Primary use
no accompanying RFC or public protocol specification is documented by IANA beyond the registered name/description
Other/unofficial uses
Unknown — no specific software product, vendor, or open-source project could be confirmed as using this port; general aggregator sites (SpeedGuide, tcp-udp-ports.com) restate the bare IANA registration without added attribution, and SpeedGuide's page returned HTTP 403
Security implications
no CVEs, malware, or C2 activity specifically tied to port 281 were found in this pass; negligible real-world exposure per nmap frequency data
Typically seen on
Unknown — no confirmed deployment context
- Analyst note
- an open port 281 would be unusual given its near-zero scan prevalence; treat as an anomaly worth individual investigation rather than a known signature, since no malware or CVE association exists.
About port 281/udp.
Port 281/udp is registered with IANA under the service name personal-link, with the description "Personal Link" and assignee/contact listed as [Dan_Cummings] (Dan Cummings). The registry entry carries no Modification Date, Registration Date, IANA reference (RFC), Service Code, or Assignment Notes — those fields are blank in the source registry rather than omitted here, and no RFC or other formal specification for the protocol appears to exist publicly. The same service name and description also appear on 281/tcp in an identical row, so the assignment is dual-registered across both transports under one name rather than being UDP-specific. Beyond the bare IANA listing, nothing about the port's real-world behavior is independently documented: no vendor, product, or open-source project publicly ties itself to "personal-link" on port 281, and no CVE references the port. It is also absent from Wikipedia's curated list of notable TCP/UDP ports. A handful of low-authority port-lookup sites carry unrelated and uncorroborated claims — one attributes the port to Honda Automobile Customer Service diagnostics, another (surfaced only in stale search-engine snippets) associates it with a "R00tbeer" trojan from early-2000s malware port lists — but neither claim is confirmed by the two maintained trojan-port references checked (Gary Kessler's Bad Ports List and the Chebucto trojan port table) or by any authoritative source, so both should be treated as unverified rather than fact. For an analyst, port 281 is best understood as an obscure, sparsely used IANA registration with an unknown real-world footprint; a live UDP responder on 281 warrants direct investigation rather than an assumption of either legitimate personal-link traffic or malware.
- IANA assignment
personal-link— "Personal Link"; reference blank (no RFC cited in registry); assignee/contact [Dan_Cummings]; dual-registered 281/tcp + 281/udp with an identical row [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry#L611 (udp), #L610 (tcp); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services observed open-frequency 281/udp ≈ 0.000544 (very low — roughly 5 in 10,000 scanned hosts in the nmap-services sample) [Confirmed] — nmap-services dataset; the dual-registered 281/tcp row records 0.000000 in the same dataset [Confirmed] — nmap-services dataset
- Related ports
- 281/tcp — the same
personal-linkregistration, dual-registered by IANA with an identical description ("Personal Link") and the same assignee/contact [Dan_Cummings]; a service-name and assignee search of the cached registry returns these two rows and no others, so 281/tcp is the only port related to this one by registration[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry personal-link 281/tcp
Primary use
IANA name/description only ("personal-link" / "Personal Link"); no publicly documented protocol specification, RFC, or vendor binding found
Other/unofficial uses
an uncorroborated claim on a low-authority port-lookup site (portsmaster.net) attributes the port to Honda Automobile Customer Service diagnostics; pattern is typical of auto-generated, non-authoritative port content and is not corroborated by IANA, Wikipedia, or any independent source [Unknown]
Security implications
no CVEs found referencing port 281; the port is absent from Wikipedia's curated notable-ports list; a legacy claim (stale search-engine snippet) associates the port with a "R00tbeer" trojan, but it does not appear in either of two maintained trojan-port references checked [Unknown] — https://www.garykessler.net/library/bad_ports.html, http://www.chebucto.ns.ca/~rakerman/trojan-port-table.html, https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
Typically seen on
Unknown — no independent telemetry or documented software binding available
- Analyst note
- treat any responder on 281/udp as unidentified until independently confirmed; the "Honda diagnostics" and "R00tbeer trojan" claims found in secondary sources are unverified and should not be reported as fact.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| personal-link | UDP | — | 0.05% |
| personal-link | TCP | Personal Link | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.