441
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — The registered decvms-sysmgt service has no documented current implementations, so a listener on 441/tcp does not correspond to an expected legitimate service and should be treated as anomalous if observed, notwithstanding one hedged report of ad hoc reuse as an alternate HTTPS listener.
- // common applications
- nginx Traffic on this port has no default protocol in current use under its registered decvms-sysmgt name; nginx has been reported (single community sighting) bound to 441/tcp as an ad hoc alternate HTTPS/TLS listener when port 443 was already occupied on the same host.
- // analyst note
- An open port 441 does not match any documented current software under its registered name — treat it as anomalous and investigate; if it answers a TLS handshake, ad hoc reuse as an alternate HTTPS listener (as reported once in the wild) is a plausible but unconfirmed explanation.
- // if you see it open
- No current implementation of the registered decvms-sysmgt service is documented, so a listener under its formal meaning is unexpected. No CVE or NVD record is associated with 441/tcp as of an August 2026 search, and auditmypc.com's port-441 page carries no trojan/virus verdict content. Scanning/exposure prevalence for this port specifically is not established in the sources checked. One hedged community report (a Netgate/pfSense forum thread) shows nginx with a Let's Encrypt TLS certificate bound to 441/tcp as an ad hoc alternate HTTPS listener on a host where 443 was already occupied by Unraid -- a single sighting, not a documented default for any product.
About port 441/tcp.
Port 441/tcp is IANA-registered as decvms-sysmgt, assigned to Lee Barton with no accompanying protocol specification or RFC reference, and no current software is documented implementing it. A listener under its registered meaning has no established legitimate role today, so an open 441/tcp should be treated as unexpected rather than assumed safe for public-internet exposure.
IANA dual-registers the assignment on both TCP and UDP under the same name, contact Lee_Barton, with the Reference column blank and no registration or modification date recorded. The registry's description field simply repeats the service name itself, so no additional protocol detail is documented beyond decvms-sysmgt as a name.
No production deployment of the formal decvms-sysmgt service is documented in current sources. One hedged community report (a Netgate/pfSense forum thread) describes an administrator binding nginx, with a Let's Encrypt TLS certificate, to port 441 as an alternate HTTPS listener because port 443 on that host was already claimed by Unraid — a single ad hoc sighting, not a documented default for any product.
nmap-services open-frequency data puts 441/tcp at roughly 0.014% and 441/udp at roughly 0.04% — both rare readings, consistent with a largely dormant registration rather than a widely deployed service.
- IANA assignment
decvms-sysmgt— "decvms-sysmgt"; reference (blank — no RFC cited in IANA registry); assignee Lee_Barton; dual-registered 441/tcp + 441/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry decvms-sysmgt 441/tcp, decvms-sysmgt 441/udp- Range class
- well-known (0–1023); source artifact labels this the "system" range [Confirmed] — this site's own tooling (port 441 entry)
- Prevalence
- nmap-services open-frequency 441/tcp ≈ 0.000138 (~0.014%); 441/udp ≈ 0.000395 (~0.04%) [Confirmed] — this site's own tooling (port 441 entry)
- Related ports
- other dormant legacy DEC-heritage IANA registrations in the well-known range — decladebug 410/tcp+udp ("DECLadebug Remote Debug Protocol") and dec-dlm 625/tcp+udp ("DEC DLM") [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry decladebug 410/tcp, dec-dlm 625/tcp
Primary use
formally decvms-sysmgt — read from the name as a DEC VMS system-management service; the registry's description field only repeats the service name and documents no protocol specification, and no current implementation is known [Likely] — the IANA Service Name and Transport Protocol Port Number Registry decvms-sysmgt 441/tcp, https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=441
Other/unofficial uses
one hedged community report of nginx (with Let's Encrypt TLS) bound to 441/tcp as an ad hoc alternate HTTPS listener on a host where 443 was already in use by Unraid, proxying a Nextcloud instance on port 444 — a single sighting, not a documented default
Security implications
no documented current implementation of the registered service and no CVE/NVD record as of an August 2026 search; auditmypc.com's port-441 page carries no verdict content to check; scanning prevalence is not established
Typically seen on
no known systems running the registered decvms-sysmgt service; occasionally an ad hoc alternate HTTPS/TLS listener per the single community report above [Unknown/Likely]
- Analyst note
- An open port 441 does not match any documented current software under its registered name — treat it as anomalous and investigate; if it answers a TLS handshake, ad hoc reuse as an alternate HTTPS listener (as reported once in the wild) is a plausible but unconfirmed explanation.
About port 441/udp.
Port 441/udp is registered to decvms-sysmgt, a legacy DEC VMS system-management service with no documented wire protocol in current use; it has no confirmed legitimate deployment today, and a public-internet sighting should be treated as anomalous rather than routine.
IANA lists 441 as decvms-sysmgt on both TCP and UDP, assigned to Lee_Barton; the registry's Description column merely repeats the service name rather than explaining it, and the Reference column is blank — no RFC documents the wire format. The name implies a Digital Equipment Corporation VMS system-management function from the DECnet/VMS era, but no independent specification, vendor manual, or community writeup describing the actual protocol was located.
nmap-services records an open-frequency of about 0.04% for 441/udp and 0.014% for 441/tcp, both negligible in scan corpora and consistent with a service tied to an operating-system lineage — VMS/OpenVMS — that is uncommon on today's internet-facing infrastructure. No credible sighting of current software using this port turned up in vendor documentation, blogs, or forums.
SANS Internet Storm Center's port-441 dashboard shows ongoing, non-zero scan and reconnaissance traffic against the port as of an August 2026 check, though its combined tcp/udp counts do not isolate legitimate responses from probing. That background noise confirms attackers routinely test the port; it does not establish that any legitimate service is actually listening.
- IANA assignment
decvms-sysmgt— Description column also reads "decvms-sysmgt" (no separate explanatory text); Reference blank (no RFC cited); assignee Lee_Barton; dual-registered 441/tcp + 441/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry decvms-sysmgt 441/udp- Range class
- well-known (0–1023)
- Prevalence
- nmap-services open-frequency 441/udp ≈ 0.000395 (~0.04%); 441/tcp ≈ 0.000138 (~0.014%) [Confirmed] — this site's own tooling
- Related ports
- other legacy DEC-registered service ports in the well-known range; contrast modern remote-management protocols (SSH/22, RDP/3389, SNMP/161)
Primary use
DEC VMS system-management protocol (decvms-sysmgt), inferred from the registry name only; no independent wire-protocol specification or RFC located [Likely] — the IANA Service Name and Transport Protocol Port Number Registry decvms-sysmgt 441/udp; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv
Other/unofficial uses
None documented as of an August 2026 search; no credible community-sourced application sightings found [Unknown]
Security implications
no documented current legitimate deployment; SANS ISC records ongoing scan/reconnaissance traffic against port 441 (tcp+udp combined), non-zero as of an August 2026 check; no CVE recorded in the NVD as of this search tied specifically to 441/udp
Typically seen on
historical/legacy DEC VMS (OpenVMS) hosts, if anywhere; otherwise treat an open 441/udp as an anomaly worth investigating
- Analyst note
- An open UDP/441 has no confirmed legitimate current application behind it; treat a sighting as anomalous and investigate rather than assume a benign, expected service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| decvms-sysmgt | UDP | — | 0.04% |
| decvms-sysmgt | TCP | — | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.