473
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — The port carries no confirmed protocol, no documented legitimate deployment, and a near-zero measured open frequency, so an observed open instance should be investigated rather than treated as routine.
- // analyst note
- registration and near-zero prevalence with no protocol documentation mean an open 473/tcp is unusual and should be investigated rather than assumed benign.
- // if you see it open
- No malware/trojan association is confirmed as of an August 2026 search; GRC's Port Authority lists no flags for port 473. No CVE is recorded as of an August 2026 search. No vendor documentation or community sighting describes an intended deployment, so an open 473/tcp should be treated as anomalous rather than routine.
About port 473/tcp.
Port 473/tcp carries no confirmed live protocol; it is registered with IANA under the bare name hybrid-pop and should not be assumed to belong on the public internet without further evidence. The registry entry gives no description text, no RFC or other reference, and no registration or modification date.
The name pairs "hybrid" with "pop," suggesting a mail-retrieval (POP) related service tied to a vendor or product called Hybrid — a plausible reading given the assignee's contact domain — but IANA publishes no protocol specification confirming this, so the functional purpose stays unconfirmed. The entry is dual-registered on TCP and UDP, with assignee Rami Rubin.
No community-sourced documentation of software actually generating traffic on this port was found. General port-lookup pages (auditmypc.com, speedguide.net) either returned no usable port-specific content or were unreachable during the research pass, and neither is cited here for a security verdict as a result. GRC's Port Authority entry for port 473 shows no security or trojan-related flags.
Given the near-zero measured open frequency and the absence of any documented deployment, an analyst encountering 473/tcp open in the wild should treat it as unusual and worth investigating rather than assuming a routine service.
- IANA assignment
hybrid-pop; no description text beyond the service name; assignee Rami Rubin ([Rami_Rubin]); reference blank; dual-registered 473/tcp + 473/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry hybrid-pop 473/tcp- Range class
- system/well-known (0–1023, IANA "system" range) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry hybrid-pop 473/tcp
- Prevalence
- measured open-frequency 473/tcp = 0.000013; 473/udp = 0.000445 [Confirmed] — this site's own tooling (built from nmap-services)
- Related ports
- other POP-family ports (110/tcp POP3, 995/tcp POP3S) by name association only; not confirmed as functionally related [Unknown]
Primary use
unclear; the name suggests a POP (mail retrieval) related service associated with a "Hybrid" product/vendor, but no IANA description or RFC confirms this
Other/unofficial uses
none documented [Unknown]
Security implications
no malware/trojan association found; no CVE found; no documented deployment evidence
Typically seen on
no documented deployment pattern found [Unknown]
- Analyst note
- registration and near-zero prevalence with no protocol documentation mean an open 473/tcp is unusual and should be investigated rather than assumed benign.
About port 473/udp.
Port 473/udp is IANA-registered under the service name hybrid-pop, assigned to Rami Rubin (hybrid.com), but no RFC or published specification describes what the protocol actually does; because nothing about its function is documented, there is no known legitimate reason it would need to be reachable from the public internet, and it should stay closed or restricted to internal use.
The IANA record leaves the reference field, registration date, and modification date all blank, and 473/tcp carries the same hybrid-pop name as a dual registration. No independent documentation of the protocol's purpose, message format, or intended use case was located as of an August 2026 search.
Measured against the nmap-services corpus, this site's own tooling records 473/udp at an open-frequency of 0.000445 (~0.0445%) and 473/tcp at 0.000013 (~0.0013%) — both very low readings, consistent with a registered-but-rarely-deployed or vestigial assignment rather than an actively used service.
No community-sourced sighting — vendor documentation, blog post, or forum/support thread — names a specific application that generates traffic on 473/udp, and no credible source ties the port to malware or trojan activity as of an August 2026 search. General port-lookup aggregator pages list the port number without adding further detail, and one candidate source (SpeedGuide) could not be retrieved (HTTP 403).
- IANA assignment
hybrid-pop— description "hybrid-pop"; assignee Rami Rubin; reference field blank; dual-registered 473/tcp + 473/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry hybrid-pop 473/udp- Range class
- well-known (0–1023); nmap-services classifies it under "system" range [Confirmed] — this site's own tooling
- Prevalence
- nmap-services open-frequency 473/udp = 0.000445 (~0.0445%); 473/tcp = 0.000013 (~0.0013%) [Confirmed] — this site's own tooling
- Related ports
- 473/tcp (dual-registered
hybrid-pop) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry hybrid-pop 473/tcp
Primary use
undocumented — IANA lists only the service name and assignee contact, with no protocol description or RFC
Other/unofficial uses
none documented as of an August 2026 search [Unknown]
Security implications
no known legitimate deployed service, no documented protocol, no reported malware association found as of an August 2026 search; treat an open 473/udp as unexpected and worth investigating
Typically seen on
Unknown — no documented deployments or typical host types were found as of an August 2026 search [Unknown]
- Analyst note
- A responsive 473/udp has no confirmed legitimate application behind it; given the blank IANA reference and absence of any independent documentation, treat it as an anomaly worth investigating rather than a normal service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| hybrid-pop | UDP | — | 0.04% |
| hybrid-pop | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.