31337

Port 31337/tcp is one of the most iconic numbers in security folklore, though its current registry status and its reputation point in completely different directions. As of a 2021 assignment, 31337 is no longer unassigned: the canonical IANA Service Name and Transport Protocol Port Number Registry lists both 31337/tcp and 31337/udp under the service name eldim ("eldim is a secure file upload proxy"), registered 2021-05-14 to Antonios A. Chariton — a niche open-source upload-proxy project, not the source of the port's fame, and the registry cites no RFC for it. The number's notoriety is entirely historical and de-facto: 31337 is the leetspeak rendering of "eleet"/"elite," and for years it was the default listener for Back Orifice, the remote-administration trojan released by Sir Dystic of the Cult of the Dead Cow (cDc) at DEF CON 6 on August 1, 1998. Back Orifice is a client/server RAT that gave an attacker full remote control of Windows 95/98 hosts — file system, registry, process control, keystroke logging — listening by default on UDP 31337 (the port and password are configurable, and TCP variants exist); the successor Back Orifice 2000 (BO2K), presented at DEF CON 7 in July 1999, added Windows NT support and was released as open source. That trojan history predates and is unrelated to the 2021 eldim assignment. Because the port is arbitrary and configurable, 31337 alone is neither necessary nor sufficient evidence of a Back Orifice infection. In the modern internet, an open 31337 is far more often a deliberate tool default (Nmap's Ncat uses it, and some consumer routers have been observed defaulting to it) or a honeypot than real Back Orifice, but it remains a long-standing IDS-signature trigger (Snort historically shipped a dedicated Back Orifice preprocessor) and a low-effort attacker "calling card." For an analyst, treat an open 31337 as worth a look — verify the listening process rather than assuming Back Orifice, and escalate only if the process or behavior is genuinely suspicious.

IANA assignment

eldim — "eldim is a secure file upload proxy"; assignee Antonios A. Chariton; registered 2021-05-14; covers both 31337/tcp and 31337/udp; reference blank (no RFC cited) [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Prevalence

nmap-services labels 31337 "Elite"; not a high-frequency open port today [Well-established] — nmap-services file

Related ports

31338, 31339 (other BO-era trojan ports); contrast 12345 (NetBus), 1243/6776 (SubSeven)

Primary use

Officially, the eldim secure file-upload proxy (a niche open-source project) since 2021-05-14. By reputation, 31337 is far better known as the Back Orifice trojan's default listener and the "eleet/elite" port — de-facto use that predates and is unrelated to the eldim assignment [IANA-assigned for eldim; Threat-reported for Back Orifice] — IANA registry; SANS ISC; cDc/DEF CON

Other/unofficial uses

Nmap Ncat default; some consumer routers; honeypots; "leet" tribute reuse by later trojans [Well-established/Community-reported]

Security implications

classic Back Orifice infection indicator and IDS-signature trigger (e.g. Snort bo preprocessor on UDP/31337); port is configurable so 31337 alone is weak evidence; modern hits usually tool-default/honeypot

Typically seen on

historically Back-Orifice-infected Windows hosts / IDS alerts; today Ncat defaults, honeypots, deliberate setups, and occasional eldim deployments

Analyst note

An open 31337 today is most often a tool default (Ncat, some routers) or a honeypot, not real Back Orifice — and only rarely the IANA-assigned eldim service. Verify the listening process before assuming infection.