505

Port 505/tcp carries mailbox-lm, an IANA-registered service name with no elaborating description, RFC, or vendor documentation behind it; because no primary source describes what actually runs there, it should be treated as an unknown quantity and kept off the public internet by default rather than assumed safe.

IANA lists mailbox-lm as dual-registered on both 505/tcp and 505/udp, assigned to Beverly Moody, with the IANA Reference column left blank — the registry supplies only the bare name and no protocol specification. The name suggests some kind of mailbox-related license-manager function, but no fetched source (IANA text, RFC, or vendor page) confirms a specific product or protocol tied to this registration, and a possible link to HP OpenMail was checked and found unsupported.

No forum, blog, vendor document, or port-lookup aggregator surfaced a named application generating traffic on 505/tcp; secondary aggregator sites (t1shopper, portdb.io, ports.my-addr.com) only repeat the bare IANA label without software attribution, so they don't count as sightings. In the absence of any documented deployment, the safest posture is to treat an open 505/tcp as unexplained rather than as a recognized, expected service.

Exposure

Function beyond the bare IANA name is undocumented, so no legitimate public-internet use case can be confirmed or ruled out; default to internal-only handling until the service behind an open port is identified. [Unknown]

Malware/Trojan

Not listed as malware-associated on auditmypc.com's port-505 page — a negative finding only, distinct from that site's boilerplate caveat text. [Likely] — auditmypc.com/tcp-port-505.asp

Mytob check

A speculative link to the Mytob worm was checked against Microsoft and Fortiguard threat-encyclopedia entries; none of Mytob's documented backdoor/IRC ports (6667, 10087, 10887, 24300) is 505, so no credible source ties Mytob to this port. [Confirmed negative]

CVE

No CVE tied to port 505 was found in the NVD as of an August 2026 search. [Unknown]

IANA reference

The Reference column for this assignment is blank — no RFC or spec backs the registration. [Confirmed]

IANA assignment

mailbox-lm — description field is the bare name only, no elaboration; assignee Beverly Moody; reference blank; dual-registered 505/tcp + 505/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mailbox-lm 505/tcp

Range class

system/well-known-adjacent (0–1023, "system" per the nmap-services frequency data) [Confirmed] — this site's own tooling (port 505)

Prevalence

nmap-services open-frequency 505/tcp = 0.000038 (~0.0038%); 505/udp = 0.000807 (~0.08%), per the repo's built port-data artifact [Confirmed] — this site's own tooling (port 505)

Related ports

505/udp (dual-registered under the same mailbox-lm name) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mailbox-lm 505/udp

Primary use

Unknown — no primary source names the specific product or protocol behind mailbox-lm

Other/unofficial uses

none found; a speculative HP OpenMail naming link was checked and found unsupported by any source [Unknown]

Security implications

function is undocumented beyond the registered name; not listed as malware-associated on auditmypc.com (negative finding); no CVE found in NVD as of August 2026

Typically seen on

no documented deployment pattern surfaced; treat any open instance as unexplained pending further evidence [Unknown]

Analyst note

An open 505/tcp cannot be attributed to a known application from current research; investigate rather than assume it is benign or malicious.

Port 505/udp carries a service IANA registered only as "mailbox-lm," and with no published protocol specification, real-world software identified, or documented attack history, it should be treated as an unverified, low-visibility port rather than one known to belong on the public internet.

The IANA Service Name and Transport Protocol Port Number Registry lists 505/udp under the name mailbox-lm, assigned to Beverly_Moody, with both the Reference and Registration Date columns blank. The identical registration also exists on 505/tcp, so the name is dual-registered but the registry provides no RFC or technical document describing what "mailbox-lm" actually does on the wire.

No independent web sources — mirror port databases, vendor documentation, forum posts, or game/P2P/VPN client references — were found describing software that generates traffic on this port. Community-sourced sightings were actively searched for and none surfaced, which is reported here as an honest abstention rather than a negative finding.

Nmap's nmap-services open-frequency data (bundled in this project's port dataset) records a measured, non-zero open-frequency for 505/udp of 0.000807, versus 0.000038 for 505/tcp — both are sampled scan-observation rates, not indicators of legitimate or malicious use.

Exposure

Unknown — no protocol specification or vendor documentation exists to judge whether this service was ever intended to face untrusted networks; treat any observed listener as unexplained until identified.

Malware/Trojan association

Not established. No CVE or malware-family association for 505/udp is recorded in the sources reviewed as of an August 2026 search.

Scanning note

UDP port scanning generally yields weaker open/closed signals than TCP (closed ports often return an ICMP port-unreachable, and open UDP services frequently don't respond to an empty probe), per Nmap's documentation — a general caveat, not specific to this port.

Recommendation

With no RFC, no known software, and no attack telemetry tied to this port, an unexpected listener on 505/udp should be investigated as an anomaly rather than assumed benign.

IANA assignment

mailbox-lm — description repeats the service name verbatim; reference blank; assignee Beverly_Moody; dual-registered 505/tcp + 505/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry mailbox-lm 505/udp

Range class

system/registered (well-known range, 0–1023 boundary at 1023; 505 falls in the "system" range per the project's port dataset) [Confirmed] — this site's own tooling (port 505, range: "system")

Prevalence

nmap-services open-frequency 505/udp = 0.000807 (measured, sampled); 505/tcp = 0.000038 [Confirmed] — this site's own tooling

Related ports

505/tcp (identical dual registration, same "mailbox-lm" name); the broader unassigned/sparsely-documented registered-port range near 500–510

Primary use

Unknown — no RFC or technical specification is published beyond the bare IANA name registration

Other/unofficial uses

None identified; no vendor docs, blog posts, or forum threads reporting real-world software on this port were found as of this search

Security implications

no CVE or malware-family association recorded as of an August 2026 search; auditmypc.com's port-505 verdict line could not be independently retrieved/confirmed either way in this search

Typically seen on

Unknown — no host population or software has been documented using this port [Unknown]

Analyst note

A sourced Unknown is the honest answer here — 505/udp is a registered-but-undocumented service; there is no basis to call it either a normal service or a known threat.