488
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — No mainstream service is documented running gss-http on 488/tcp, prevalence is measured at 0, and the only historical sighting is a distinct, hedged, single-source UDP use, so a legitimately open 488/tcp would be unexpected.
- // analyst note
- An open port 488/tcp has no known legitimate mainstream use; treat it as an anomaly worth investigating rather than a normal service.
- // if you see it open
- No confirmed malware/trojan association as of an August 2026 search. The port is essentially unused in practice, so an open 488/tcp is anomalous and should be investigated rather than treated as an expected service.
About port 488/tcp.
Port 488/tcp carries no widely-deployed service; IANA reserves it for gss-http, but the registry entry has no elaborating description and no mainstream software is documented actually running there, so an open port 488/tcp is anomalous and should not be treated as expected on the public internet.
IANA registers gss-http on 488 for both TCP and UDP, assignee Doug Rosenthal, with a blank Reference field — no RFC or specification is cited. The service name implies GSS-API-negotiated HTTP, but the bare registration gives no protocol detail, and no widely-adopted product has been found implementing it on this port.
The one credible community sighting is a 1999 Usenet thread (archived on Google Groups, comp.unix.sco.misc) reporting that on SCO OS 5.0.5 systems, UDP port 488 was used by sco_cpd, part of SCO's licensing system that checks for duplicate licenses across the network. A thread participant noted this conflicts with the IANA gss-http assignment on the same number; the sighting is single-source, hedged, and about UDP rather than TCP.
Measured prevalence from the repo's port-data artifact shows 488/tcp at an open-frequency of 0 (sampled, not observed open) and 488/udp at roughly 0.000643 — both consistent with a port that sees essentially no real-world traffic today.
- Exposure
- No verified mainstream service runs
gss-httpon 488/tcp; an open port 488/tcp is unexpected and warrants investigation rather than being assumed legitimate. - Historical conflict
- A 1999 Usenet report describes SCO's
sco_cpdlicensing daemon using UDP 488, conflicting with the IANA gss-http assignment on the same number (single hedged source, UDP not TCP). - Malware association
- No credible, verifiable malware or trojan association for this port was confirmed as of an August 2026 search; a vendor scanner-signature page returned inconsistent content across fetches and is not relied on for a positive attribution here.
- Prevalence
- nmap-services open-frequency for 488/tcp measures 0 (sampled, not observed open); 488/udp measures approximately 0.000643, per the repo's port-data artifact.
- IANA assignment
gss-http— bare name, no description; assignee Doug Rosenthal; blank Reference field; dual-registered 488/tcp + 488/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry gss-http 488/tcp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 488/tcp = 0 (sampled, not observed open); 488/udp ≈ 0.000643 [Confirmed] — this site's own tooling
- Related ports
- no closely related port cluster identified for gss-http [Unknown]
Primary use
nominally GSS-API-negotiated HTTP per the service name, but no elaborating IANA description and no documented mainstream implementation as of an August 2026 search
Other/unofficial uses
SCO sco_cpd licensing daemon reported on UDP 488 for SCO OS 5.0.5 (single 1999 Usenet source, not TCP)
Security implications
no confirmed malware/trojan association as of an August 2026 search; essentially unused, so an open instance is anomalous
Typically seen on
none confirmed; legacy SCO OS 5.0.5 hosts is the sole (unverified, UDP) historical sighting [Unknown]
- Analyst note
- An open port 488/tcp has no known legitimate mainstream use; treat it as an anomaly worth investigating rather than a normal service.
About port 488/udp.
Port 488/udp is registered with IANA under the name "gss-http," but the registry attaches no RFC or protocol specification to it — it is effectively a name-only assignment. No widely deployed standard service is documented as using 488/udp today, so a response on this port should be treated as an anomaly rather than an expected public-facing service.
IANA lists gss-http as dual-registered on both 488/tcp and 488/udp, assignee [Doug_Rosenthal], with a blank Reference column. The name implies an HTTP variant secured via the Generic Security Service API (GSS-API), but that idea was never formalized into a specification, and no current mainstream software is documented implementing it.
The most concrete real-world sighting comes from a Usenet support thread for SCO UnixWare/OpenServer, where users identified UDP port 488 as used by sco_cpd, the license-checking daemon in SCO's networked licensing system that polls other hosts on the network for duplicate license usage; one poster reported that blocking it externally caused dial-up lines to redial repeatedly. This is a single-source, community-reported association, not a formal protocol assignment, and it postdates and conflicts with the registered "gss-http" name.
The measured nmap-services open-frequency for 488/udp is 0.000643 (~0.06%), recorded as a real sampled reading; the 488/tcp companion frequency is 0, also a genuine sampled reading rather than an absence.
- Exposure
- No documented legitimate reason for 488/udp to be reachable from the public internet; the IANA entry is name-only and no live standard service is known to use it, so an open port here is worth investigating rather than assuming benign.
- Legacy association
- SCO UnixWare/OpenServer's
sco_cpdlicensing daemon has been reported using UDP 488 on internal/dial-up networks in a single community thread, not a formal registration.
- IANA assignment
gss-http— no elaborated description beyond the service name; reference (blank — no RFC cited); assignee[Doug_Rosenthal]; dual-registered 488/tcp + 488/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry gss-http 488/udp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 488/udp = 0.000643 (~0.06%); 488/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling
- Related ports
- 488/tcp (same dual registration, "gss-http" name)
Primary use
name-only IANA registration ("gss-http"); no RFC or protocol spec attached; no widely-deployed standard service documented using it as of an August 2026 search
Other/unofficial uses
SCO UnixWare/OpenServer sco_cpd licensing daemon reported using UDP 488
Security implications
no CVE recorded in NVD as of an August 2026 search; auditmypc.com content inconsistent across fetches, no trojan assertion made from it; GRC Port Authority lists no trojan association
Typically seen on
legacy SCO Unix hosts running networked licensing (sco_cpd); otherwise an anomaly
- Analyst note
- An open 488/udp is not expected on a general-purpose network; investigate as a possible legacy SCO licensing-daemon remnant or an anomaly rather than assume a functioning GSS-API HTTP service.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| gss-http | UDP | — | 0.06% |
| gss-http | TCP | — | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.