380
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — IS-99 is an obsolete legacy CDMA modem-server function with no evidence of active modern deployment, so a responsive port 380 today is not an expected legitimate service and warrants investigation.
- // analyst note
- A responsive port 380 has no known legitimate modern use — treat as anomalous and investigate rather than assume a routine service.
- // if you see it open
- No CVE, honeypot report, or documented exploitation campaign specific to port 380 was found. Aggregator site auditmypc.com applies generic templated language ('a Trojan or Virus has used this port in the past') across many unrelated ports without naming a specific malware family or incident, so it is treated as low-confidence boilerplate rather than a documented threat. Given the obsolete, niche legitimate use (legacy CDMA modem-server), an open port 380 today is not expected and is not a documented common scanning target.
About port 380/tcp.
Port 380/tcp carries is99s, the IANA-registered TIA/EIA/IS-99 modem-server service; it is an obsolete legacy assignment with no evidence of active modern use, so a responsive port 380 today is anomalous rather than an expected service on the public internet or an internal network.
IANA registers 380 as is99s — "TIA/EIA/IS-99 modem server" — dual-registered on both TCP and UDP, with assignee Frank Quick and a blank Reference field; no RFC is cited for this assignment (IANA Service Name and Transport Protocol Port Number Registry).
TIA/EIA-IS-99 is a mid-to-late-1990s industry specification for circuit-switched data sessions over CDMA cellular networks, defining a modem-server function that let cellular devices dial into a network-side modem pool. Port 379 (is99c) is the paired client-side assignment; port 380 is the server side.
No evidence of active modern deployment was found. Port-lookup aggregator sites (t1shopper, SpeedGuide, adminsub.net, tcp-udp-ports.com) simply restate the IANA registration rather than describing observed application traffic, and no forum, blog, or product documentation ties a current piece of software to this port.
- IANA assignment
is99s— "TIA/EIA/IS-99 modem server"; reference (blank — no RFC cited in IANA registry); assignee Frank Quick; dual-registered 380/tcp + 380/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- no nmap-services open-frequency figure was surfaced in research for 380/tcp [Unknown]
- Related ports
- 379/tcp+udp (
is99c, the paired client-side assignment) [Confirmed]
Primary use
legacy TIA/EIA/IS-99 modem-server function for circuit-switched data over CDMA cellular networks (mid-to-late 1990s)
Other/unofficial uses
none identified; port-lookup aggregators only restate the IANA registration, no third-party application sightings found [Unknown]
Security implications
no CVE, honeypot report, or documented exploitation campaign specific to this port; auditmypc.com's "used by malware in the past" note is generic templated boilerplate repeated across many unrelated ports, not a specific documented incident
Typically seen on
essentially absent from modern traffic; historically tied to legacy CDMA carrier infrastructure only, if ever deployed [Likely]
- Analyst note
- A responsive port 380 has no known legitimate modern use — treat as anomalous and investigate rather than assume a routine service.
About port 380/udp.
Port 380/udp carries the IANA-registered is99s service — the TIA/EIA/IS-99 modem server — and it is not expected to face the public internet; a live listener here should be treated as anomalous rather than routine traffic.
IANA registers port 380 for is99s on both TCP and UDP, with the description "TIA/EIA/IS-99 modem server" and assignee Frank_Quick. It pairs with port 379 (is99c, the IS-99 modem client). No RFC or other reference is cited, and the registry's Registration Date column is blank — both fields stay blank here rather than guessed.
IS-99 was a mid/late-1990s TIA/EIA standard for circuit-switched cellular digital data, effectively "modem over cellular" service used to carry dial-up-style sessions across early digital cellular networks. That use case has been obsolete for well over a decade as carriers moved to packet-switched data, and no vendor documentation, blog post, or forum thread was found describing current software that still uses 380/udp.
Generic port-scan reference sites carry boilerplate warnings tying port 380 to historical trojan/backdoor activity, but no named malware family, CVE, or dated incident specifically implicates 380/udp in current threat intelligence. Given IS-99's obsolescence, unsolicited traffic on this port is more plausibly scanner noise, misconfiguration, or a stale default-list artifact than active legitimate use.
- IANA assignment
is99s— "TIA/EIA/IS-99 modem server"; reference (blank — no RFC cited); assignee Frank_Quick; dual-registered 380/tcp + 380/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry- Range class
- well-known (0–1023)
- Prevalence
- nmap-services observed open-frequency 380/udp ≈ 0.000494 — very low (roughly 5 in 10,000 scanned hosts in the nmap-services sample) [Likely] — nmap-services dataset
- Related ports
- 379/tcp,udp (
is99c, IS-99 modem client) — paired IANA registration [Confirmed]
Primary use
server-side endpoint for legacy IS-99 circuit-switched cellular modem data sessions
Other/unofficial uses
none documented; no confirmed modern software usage found on 380/udp [Unknown]
Security implications
generic scan-reference sites carry boilerplate trojan/backdoor association claims; no confirmed CVE or named malware family ties specifically to 380/udp
Typically seen on
legacy/obsolete cellular modem infrastructure historically; otherwise anomalous if seen today
- Analyst note
- IS-99 is obsolete; an open 380/udp today is more likely scanner noise, misconfiguration, or a decoy than legitimate service traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| is99s | UDP | TIA/EIA/IS-99 modem server | 0.05% |
| is99s | TCP | TIA/EIA/IS-99 modem server | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.