368
Summary
- // typical exposure
- Restricted (trusted networks only) — If this is in fact a WinGate gateway/proxy discovery service as the registrant's identity suggests, it is an administrative/internal-networking function that belongs on trusted networks, not exposed to the open internet.
- // common applications
- WinGate (Qbik NZ Ltd) Traffic on this port is most often incidental internet-wide scanning; the registered QbikGDP service name is plausibly tied to Qbik's WinGate gateway/proxy suite, though current vendor documentation does not confirm active use of the port.
- // analyst note
- An unexpected listener on 368 is uncommon enough to warrant verification of the actual process rather than assuming it is benign scanning noise.
- // if you see it open
- No confirmed CVEs or exploitation reports tied to port 368. SANS ISC scanning data is consistent with routine internet-wide sweeps rather than targeted campaigns. Because the service is obscure and its WinGate association is unconfirmed, an unexpected listener on this port should be verified rather than assumed benign.
About port 368/tcp.
Port 368/tcp carries QbikGDP, a narrow, single-vendor IANA registration likely tied to Qbik NZ Ltd's WinGate gateway/proxy suite; it is a low-prevalence, poorly-documented service that should stay on trusted internal networks rather than be exposed to the public internet.
IANA lists 368 as qbikgdp — "QbikGDP" — registered by Adrien de Croy, with a blank Reference field (no RFC is cited, and none should be inferred). The registration is dual-listed on both 368/tcp and 368/udp with identical metadata.
Adrien de Croy is the founder of Qbik NZ Ltd, maker of the WinGate Windows proxy/gateway product (HTTP proxy and cache, SOCKS/multi-protocol proxy, mail gateway, HTTPS inspection). That makes a WinGate-family discovery or announcement protocol the most plausible explanation for QbikGDP, but current WinGate vendor documentation makes no mention of the term or of port 368, so the link is inferred from the registrant's identity rather than confirmed. Wikipedia's list of TCP/UDP ports has no entry for 368 at all, underscoring how obscure this registration is.
A point-in-time check of SANS Internet Storm Center's port-368 scanning dashboard showed only low, sporadic scan volume — a handful to low hundreds of source-IP hits on sampled days — consistent with routine internet-wide port sweeps rather than a targeted campaign, and no CVEs are listed against the port. No other credible community-sourced sightings (vendor blogs, forum threads) of software using port 368 were found.
- IANA assignment
qbikgdp— "QbikGDP"; reference (blank — no RFC cited); assignee/contact Adrien de Croy; dual-registered 368/tcp + 368/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 729; IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151 boundary N/A — 368 is actually well-known, 0–1023) [Confirmed]
- Prevalence
- not covered by Wikipedia's List of TCP and UDP port numbers (table skips 366→369), consistent with a narrow, single-vendor registration [Confirmed absence] — https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
- Related ports
- no confirmed cluster; nearest documented well-known neighbors are sparsely populated in this range
Primary use
registered discovery/announcement-style service name "QbikGDP" with no published protocol specification [Confirmed registration / Unknown protocol behavior] — IANA registry
Other/unofficial uses
likely associated with Qbik NZ Ltd's WinGate gateway/proxy suite, inferred from the registrant's identity; not confirmed by current WinGate vendor documentation [Likely] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=368, https://www.wingate.com/
Security implications
low, sporadic scan volume per SANS ISC point-in-time check; no CVEs found tied to the port
Typically seen on
possibly WinGate proxy/gateway deployments (Windows); otherwise rare/unexplained [Likely/Unknown]
- Analyst note
- An unexpected listener on 368 is uncommon enough to warrant verification of the actual process rather than assuming it is benign scanning noise.
About port 368/udp.
Port 368/udp carries QbikGDP, a proprietary IANA-registered service tied to Qbik Software's WinGate proxy/gateway product; it is undocumented publicly, so it should be treated as internal-only rather than exposed to the public internet.
IANA lists 368 as qbikgdp ("QbikGDP") on both TCP and UDP, assigned to Adrien de Croy with a blank Reference field — no RFC or public specification is cited. Qbik Software's own site now redirects to wingate.com, confirming the registrant is the vendor behind WinGate, a Windows-based internet gateway/proxy server aimed at small-to-medium networks.
No documentation of the GDP protocol itself — what "GDP" stands for or how it behaves on the wire — was found on the current vendor site or in Wikipedia's port list. The name and the UDP-skewed real-world usage (nmap-services shows 368/udp at a nonzero but rare frequency versus 368/tcp effectively unseen) are consistent with a lightweight discovery or broadcast mechanism rather than a general-purpose service.
No CVE, malware, or trojan association surfaced for this port in this research pass, and a broader community-sightings sweep (forums, honeypot writeups) was not completed this session due to search-budget limits.
- IANA assignment
qbikgdp— "QbikGDP"; reference (blank — no RFC cited); assignee Adrien de Croy; dual-registered 368/tcp + 368/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry
- Prevalence
- nmap-services frequency 368/udp ≈ 0.000264 (rare, nonzero); 368/tcp ≈ 0.000000 (effectively unseen) [Likely] — https://raw.githubusercontent.com/nmap/nmap/master/nmap-services
- Related ports
- no directly related cluster identified in this research pass [Unknown]
Primary use
proprietary service registered to Adrien de Croy of Qbik Software, maker of the WinGate proxy/gateway; exact wire protocol undocumented publicly
Other/unofficial uses
none documented [Unknown]
Security implications
no CVE/malware/trojan association found this pass; undocumented protocol plus WinGate vendor tie suggests internal LAN discovery use rather than public exposure
Typically seen on
WinGate (Qbik Software) proxy/gateway deployments, Windows-based
- Analyst note
- treat an internet-facing 368/udp responder as anomalous pending further correlation; not a documented public-facing service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| qbikgdp | UDP | — | 0.03% |
| qbikgdp | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.