472
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No protocol specification or known implementation exists for ljk-login, so traffic observed on 472/tcp lacks any documented legitimate use and should be treated as anomalous and investigated.
- // analyst note
- An open port 472/tcp has no known legitimate real-world use and an unresolved assignee — investigate as anomalous rather than assume it is a benign
ljk-loginlogin service. - // if you see it open
- No CVE referencing port 472 is recorded in the NVD as of an August 2026 search. No malware/trojan family is attributed to 472/tcp in any source retrieved as of that search; auditmypc.com hosts a dedicated port-472 page but its verdict content could not be retrieved to confirm a clean or dirty finding. The blank IANA reference, unresolved '[LJK]' assignee, and near-zero measured prevalence together indicate no established legitimate deployment pattern.
About port 472/tcp.
Port 472/tcp carries the IANA-registered service ljk-login, but what actually runs on it and whether it belongs on the public internet cannot be confirmed — no protocol specification, vendor documentation, or observed real-world traffic for this port turned up in research, so the honest answer is Unknown rather than a guess.
The IANA registry lists the service name ljk-login for both 472/tcp and 472/udp, with the Reference column blank and the assignee recorded only as the terse tag [LJK], which does not resolve to any documented organization or product name.
The service name implies some kind of login or authentication function, but IANA provides no RFC, protocol draft, or further description beyond the bare name. No community-sourced sighting (vendor docs, blog posts, forum threads) of any application actually generating traffic on 472/tcp was found as of an August 2026 search.
Prevalence data from the nmap-services frequency data (built from nmap-services) shows 472/tcp at an open-frequency of 0.000013 (about 0.0013%) and 472/udp at 0.000758 (about 0.076%) — both extremely low, consistent with a registration that sees little to no legitimate real-world use.
- Exposure
- No documented protocol or known implementation exists for
ljk-login, so 472/tcp has no established legitimate deployment pattern; treat any observed traffic as unexplained rather than expected. - Malware association
- No malware or trojan family is attributed to 472/tcp in any source retrieved as of an August 2026 search; auditmypc.com maintains a page for TCP port 472, but its verdict content could not be retrieved to confirm a clean or dirty finding either way.
- Analyst guidance
- Given the blank IANA reference, unresolved assignee tag, and near-zero prevalence, an observed open port 472/tcp warrants investigation as an anomaly rather than being assumed to be the registered
ljk-loginservice.
- IANA assignment
ljk-login— description "ljk-login"; assignee[LJK]; Reference column blank; dual-registered 472/tcp + 472/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ljk-login 472/tcp- Range class
- well-known / System (0–1023) [Confirmed] — this site's own tooling (range: "system")
- Prevalence
- nmap-services open-frequency 472/tcp ≈ 0.000013 (~0.0013%); 472/udp ≈ 0.000758 (~0.076%) [Confirmed] — this site's own tooling
- Related ports
- 470 (scx-proxy), 471 (Mondex), 473 (hybrid-pop), 474 (tn-t1-w1) [Likely] — http://ports.my-addr.com/tcp_port-udp_port-application-and-description.php?port=472
Primary use
Unknown — service name suggests a login/authentication function, but no protocol specification or reference document exists
Other/unofficial uses
none found as of an August 2026 search [Unknown]
Security implications
no CVE recorded in the NVD as of an August 2026 search; no confirmed malware association; auditmypc.com hosts a port-472 page but its verdict content was not retrievable
Typically seen on
Unknown — no documented deployments identified [Unknown]
- Analyst note
- An open port 472/tcp has no known legitimate real-world use and an unresolved assignee — investigate as anomalous rather than assume it is a benign
ljk-loginlogin service.
About port 472/udp.
Port 472/udp is registered with IANA under the bare service name ljk-login, with no accompanying protocol specification; there is no evidence this port is intended for, or safe for, exposure to the public internet, and any traffic seen on it should be treated as unexplained rather than routine.
The IANA Service Name and Transport Protocol Port Number Registry lists ljk-login as dual-registered on both 472/tcp and 472/udp, assigned to the opaque tag [LJK], which does not resolve to any documented organization or product name. The Reference column is blank — no RFC or other specification document is cited — and no registration or modification date is recorded.
No technical documentation of an "ljk-login" protocol was located beyond the registry entry itself. No current product, service, or open-source implementation tied to this port name was found in an August 2026 search of vendor documentation, blogs, and forum/support threads.
Nmap's nmap-services frequency data (drawn from the nmap-services frequency data, itself built from nmap-services) records an observed-open frequency of 0.000758 for 472/udp and 0.000013 for 472/tcp in its aggregated internet-scan corpus. This is a real, if low, measured figure — not zero — but the file does not attribute the hits to any named application, and low-frequency hits on legacy service-name ports of this kind are commonly incidental or misconfigured hosts rather than confirmed ljk-login traffic.
- Exposure
- Anomalous — the registered service has no public specification, no known current implementation, and essentially no confirmed legitimate use; an open 472/udp is unusual and worth investigating rather than assuming normal.
- Malware association
- No credible malware or trojan association was substantiated in sources reviewed; auditmypc.com's port-472 pages carry only the site's standard templated disclaimer, not a port-specific verdict.
- Protocol risk
- UDP is connectionless with no built-in delivery guarantee or authentication, so any service actually listening here inherits the general UDP spoofing/amplification exposure common to unauthenticated UDP listeners — a protocol-generic note, not a port-472-specific finding.
- IANA assignment
ljk-login— description "ljk-login"; Reference blank; assignee[LJK](opaque registry tag, does not resolve to any documented organization); dual-registered 472/tcp + 472/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ljk-login 472/udp- Range class
- system/well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ljk-login 472/udp
- Prevalence
- nmap-services open-frequency 472/udp = 0.000758; 472/tcp = 0.000013 [Confirmed] — this site's own tooling (built from nmap-services)
- Related ports
- 472/tcp (dual registration, same service name) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry ljk-login 472/tcp
Primary use
Unknown — no protocol specification found beyond the bare IANA registry entry
Other/unofficial uses
none documented [Unknown]
Security implications
no NVD CVE found as of August 2026; no malware/trojan association could be established — auditmypc.com's udp-port-472 page carries only the site's standard templated disclaimer, not a port-specific verdict; UDP-generic spoofing/amplification exposure applies to any unauthenticated UDP listener
Typically seen on
Unknown — no current software or service documented as generating traffic on this port [Unknown]
- Analyst note
- Treat an open 472/udp as anomalous — the registered name has no public spec and no known current implementation, so investigate rather than assume routine service traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| ljk-login | UDP | — | 0.08% |
| ljk-login | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.