406

Port 406/tcp carries IMSP (Interactive Mail Support Protocol), an obsolete experimental mail-management protocol; it has no legitimate reason to be exposed to the public internet, and a live response on it today should be treated as anomalous rather than assumed to be a real mail service.

IANA registers 406 as imsp on both TCP and UDP, described as "Interactive Mail Support Protocol," assignee John_Myers, with a blank Reference field — no RFC was ever published for it.

IMSP was proposed in the early-to-mid 1990s as a companion to IMAP4 (port 143), adding server-side mailbox management, client configuration storage, and address-book/directory services that IMAP4 itself did not provide. It never advanced past Internet-Draft status; the IETF effort was folded into ACAP (Application Configuration Access Protocol), described in surviving documentation as a functional superset of IMSP.

No maintained client or server software implementing IMSP could be verified, and no CVE, malware family, or scanning campaign is recorded against port 406 in the IANA registry entry. SpeedGuide.net, the usual community source for port-association trivia, returned an HTTP 403 during this research and its content could not be verified, so no trojan or application sighting is claimed here.

Because the underlying protocol is defunct and no current software is confirmed to use it, a responsive port 406 in the wild is unusual and worth investigating as a misconfiguration, decoy, or unrelated service squatting on the number rather than as genuine IMSP traffic.

IANA assignment

imsp — "Interactive Mail Support Protocol"; reference (blank — no RFC cited); assignee John_Myers; dual-registered 406/tcp + 406/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 805-806)

Range class

well-known (0–1023) [Confirmed]

Prevalence

nmap-services open-frequency for 406/tcp ≈0.000163 [Confirmed] — this site's own tooling

Related ports

143/tcp (IMAP4, the protocol IMSP was designed to complement)

Primary use

experimental 1990s companion protocol to IMAP4 adding mailbox management, client config storage, and address-book services; never reached RFC status

Other/unofficial uses

none confirmed; conceptually superseded by ACAP (Application Configuration Access Protocol)

Security implications

no CVE, malware family, or scanning campaign is recorded against port 406 in the IANA registry entry; SpeedGuide.net's community port page was inaccessible (HTTP 403) during research [Unknown]

Typically seen on

no active software confirmed; protocol is effectively dormant/defunct [Likely]

Analyst note

An open/responsive port 406 is statistically unusual given the underlying protocol is abandoned — treat as an anomaly to investigate rather than routine mail infrastructure.

Port 406/udp is registered to imsp, the Interactive Mail Support Protocol; it never reached standards-track status or wide deployment, so a modern host answering on 406/udp is anomalous and worth investigating rather than an expected service.

IANA's registry lists the service name as imsp with description "Interactive Mail Support Protocol," assignee John Myers, a blank Reference field, and dual registration alongside 406/tcp. No registration date is recorded.

IMSP originated as an informal, mid-1990s companion proposal to IMAP4, intended to let sites running multiple IMAP4 servers share mailbox management, per-user configuration, and shared address-book data across a mail domain. It circulated as the Internet-Draft draft-myers-imap-imsp-03 (June 1995, Carnegie Mellon), titled "IMSP -- Internet Message Support Protocol" in the draft itself, but never advanced to a numbered standards-track RFC, and IANA's own reference field for the assignment is blank — consistent with that history rather than an omission.

Development stalled in the 1990s and no current, credible software has been identified generating traffic on this port; the only documented artifacts are legacy port-lookup references, not evidence of active use.

IANA assignment

imsp — "Interactive Mail Support Protocol"; reference (blank); assignee John Myers; dual-registered 406/tcp + 406/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 806

Range class

well-known (0–1023) [Confirmed] — same registry line

Prevalence

0.00056 (nmap-services open-frequency) [Confirmed] — this site's own tooling

Related ports

406/tcp (dual registration); 143/tcp (IMAP4); 220/tcp (IMAP3) [Confirmed/Likely]

Primary use

proposed IMAP4 companion protocol for shared mailbox management, per-user config, and address books (never standards-track; not widely deployed)

Other/unofficial uses

none documented

Security implications

no confirmed malware targets this port; a same-numbered Dr.Web catalog entry ("Trojan.Proxy.406") is a signature ID, not port-specific evidence; a legacy scanner site marks it not virus/trojan-associated

Typically seen on

no known current legitimate deployments; unexpected/anomalous if seen [Likely]

Analyst note

An open port 406 has no known legitimate modern use — treat as an anomaly signal and investigate rather than assume a benign mail-related service.