364
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No legitimate, currently-documented service is known to run on 364/tcp, so its presence in the wild is essentially never expected and should be treated as an anomaly worth investigating.
- // analyst note
- An open port 364 has no known legitimate modern use; treat as anomalous and investigate the source before assuming it is benign.
- // if you see it open
- No CVE, malware, or trojan association found for this port. The registration appears dormant with no documented current deployment, so an open or responding 364/tcp is anomalous and should be investigated as a possible misconfiguration, scanner artifact, or non-standard service rather than assumed to be the historical Aurora CMGR product.
About port 364/tcp.
Port 364/tcp is registered with IANA under the service name aurora-cmgr ("Aurora CMGR"), but no RFC or protocol specification is published for it, and no current, citable software or service has been documented actually using it. Given that gap, 364/tcp has no legitimate reason to be reachable from the public internet, and any observed traffic on it should be treated as anomalous rather than routine.
The IANA registry lists 364 as dual-registered on both TCP and UDP for aurora-cmgr, with the Reference column left blank in the source registry — no RFC or specification is cited there, and none should be invented. Secondary sources place the historical registrant as Philip Budne, with a registrant contact domain (auroratech.com) suggesting a proprietary "Aurora"-branded cluster-manager product from the early-to-mid 1990s IANA registration era; this is distinct from and unrelated to Amazon Aurora, which runs over standard MySQL/PostgreSQL ports (3306/5432).
No exact registration date could be verified, so none is stated. No vendor documentation, blog posts, forum threads, or scanning/malware reference lists (including trojan-port compilations) turned up any evidence of a currently deployed service, malware family, or botnet associated with this port — the registration appears dormant.
- IANA assignment
aurora-cmgr— "Aurora CMGR"; reference (blank — no RFC cited in IANA registry); assignee [Philip_Budne]; dual-registered 364/tcp + 364/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- no scan-frequency/nmap-services data found in this research pass [Unknown]
- Related ports
- none specifically documented
Primary use
registered service name with no published protocol specification, no RFC, and no publicly documented wire protocol; name suggests a proprietary "Aurora" cluster-manager product, unrelated to AWS Aurora
Other/unofficial uses
none documented [Unknown]
Security implications
no CVE, malware, or trojan association found; port is obscure and apparently dormant, so any observed traffic is more likely scanning noise or an anomaly than a real service
Typically seen on
no current hosts documented; historically tied to an "Aurora"-branded cluster-manager product circa the early-to-mid 1990s registration era [Unknown]
- Analyst note
- An open port 364 has no known legitimate modern use; treat as anomalous and investigate the source before assuming it is benign.
About port 364/udp.
Port 364/udp is registered with IANA under the name aurora-cmgr ("Aurora CMGR"), but no protocol specification, vendor documentation, or real-world software has been identified running on it, so its fitness for public-internet exposure is Unknown — any observed traffic should be investigated rather than assumed to be a known, benign service.
The IANA registry lists the assignee as Philip_Budne, with an identical registration mirrored on 364/tcp, and the Reference column is blank — no RFC or formal specification was ever cited for this entry. That combination (individual registrant, no accompanying standard) is typical of legacy or vendor-internal service-name reservations that were never widely deployed or publicly documented.
A search across common port-lookup and threat-intelligence references (t1shopper, SpeedGuide, GRC's Port Authority, auditmypc, adminsub.net) turned up nothing beyond a restatement of the bare IANA label — none of these sources describe an actual protocol, client, or server implementation using this port. auditmypc.com does explicitly note that UDP 364 is not associated with any known trojan or virus family in its database.
One unverified web mention linked the port to a "RemoteAnything" remote-access trojan, but this claim could not be corroborated against a primary malware-port reference (it is absent from Gary Kessler's well-known "Bad Ports" list), so it is excluded here rather than reported as fact.
- IANA assignment
aurora-cmgr— "Aurora CMGR"; reference (blank — no RFC cited); assignee Philip_Budne; dual-registered 364/tcp + 364/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 721-722); IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- Unknown — not covered by available registry/telemetry sources in this research pass [Unknown]
- Related ports
- 364/tcp — the same
aurora-cmgrregistration, dual-registered by IANA with an identical description ("Aurora CMGR") and the same assignee/contact [Philip_Budne]; a service-name and assignee search of the cached registry returns these two rows and no others, so 364/tcp is the only port related to this one by registration[Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry aurora-cmgr 364/tcp
Primary use
Unknown — no protocol specification or vendor documentation found beyond the bare IANA label [Unknown]
Other/unofficial uses
none credibly identified; checked t1shopper, SpeedGuide, GRC Port Authority, auditmypc, adminsub.net — all merely echo the IANA name
Security implications
not associated with any known trojan/virus per auditmypc.com; an unverified "RemoteAnything" association is excluded (absent from Gary Kessler's Bad Ports list)
Typically seen on
Unknown [Unknown]
- Analyst note
- A responsive 364/udp has no documented legitimate service behind it — verify the host and application before assuming benign use.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| aurora-cmgr | UDP | — | 0.04% |
| aurora-cmgr | TCP | Aurora CMGR | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.