527
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — IANA registers 527/tcp to a niche, undocumented 'stx' (Stock IXChange) service with no known vendor implementation and a measured open-frequency of 0, so any observed traffic on this port falls outside normal usage and warrants investigation.
- // analyst note
- An open 527/tcp has no documented legitimate deployment and a measured open-frequency of 0 — treat any observed listener as anomalous and worth investigating rather than assuming it is the registered
stxservice. - // if you see it open
- No CVEs, exploit write-ups, or malware/trojan associations were found for port 527 as of an August 2026 search; GRC's Port Authority page lists no security notes. Because no software is known to legitimately implement 'stx' and the measured open-frequency is 0, unexpected traffic on 527/tcp should be treated as anomalous.
About port 527/tcp.
Port 527/tcp is registered with IANA under the service name stx for "Stock IXChange"; no protocol specification, vendor implementation, or real-world deployment is publicly documented, so the port has no known legitimate reason to be reachable from the public internet.
The registration itself is thin. IANA's registry shows a modification date of 2022-01-25 for the entry, with both the assignee and contact fields listed as Ferdi_Ladeira and a blank Reference column — meaning no RFC or specification document backs the assignment on either the TCP or UDP side.
No use of port 527 by any named software could be documented. The one port-database aggregator still rendering a record for it reports only the IANA assignment itself — stx / "Stock IXChange" on both transports — and adds nothing about deployment or behavior.
Scan telemetry matches the port's obscurity: the nmap-services open-frequency for 527/tcp is measured at exactly 0 — sampled but never observed open in the corpus — while 527/udp shows a similarly thin open-frequency near 0.036%. No community-sourced reports of specific software generating traffic on 527/tcp turned up in this research.
- Exposure
- No legitimate service is documented as running on 527/tcp; a listener here should be treated as anomalous and investigated rather than assumed to be Stock IXChange traffic.
- Vulnerability record
- No CVEs or exploit write-ups are recorded for port 527 as of an August 2026 search.
- Malware association
- Not listed as malware/trojan-associated on GRC's Port Authority page for port 527 [Likely — the AuditMyPC per-port page did not return a usable result in this research, so this is not independently confirmed there].
- IANA assignment
stx— "Stock IXChange"; reference (blank — no RFC cited); assignee Ferdi_Ladeira; dual-registered 527/tcp + 527/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry stx 527/tcp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 527/tcp = 0 (sampled, not observed open); 527/udp ≈ 0.000362 [Confirmed] — this site's own tooling
- Related ports
- none identified with a documented relationship to 527/tcp in this research [Unknown]
Primary use
registered as stx (Stock IXChange); no publicly documented protocol spec or reference implementation found [Confirmed registration / Unknown protocol detail] — https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=527
Other/unofficial uses
none found; the one aggregator that still renders a port-527 record reports only the IANA stx / "Stock IXChange" assignment
Security implications
no CVEs, exploit write-ups, or malware/trojan associations found for port 527 as of an August 2026 search; GRC's Port Authority page carries no security notes
Typically seen on
no confirmed hosts or software identified in this research [Unknown]
- Analyst note
- An open 527/tcp has no documented legitimate deployment and a measured open-frequency of 0 — treat any observed listener as anomalous and worth investigating rather than assuming it is the registered
stxservice.
About port 527/udp.
Port 527/udp is IANA-registered as stx ("Stock IXChange"), but no RFC or protocol document backs the registration and no confirmed, actively deployed application uses it today. It has no legitimate reason to sit on the public internet; an open 527/udp is unusual and merits investigation rather than routine acceptance.
The IANA Service Name and Transport Protocol Port Number Registry lists stx for both 527/tcp and 527/udp identically — assignee Ferdi_Ladeira, modification date 2022-01-25, a blank Reference column, and no registration date recorded. The registry record specifies nothing about the protocol beyond the name and description.
No credible, citable sighting of a specific named application generating traffic on 527/udp was found. Nothing beyond the bare stx registration is documented for either transport.
Nmap's nmap-services frequency data records 527/udp with an open-response frequency of 0.000362, versus 0.000000 for 527/tcp in the same file — a small but real responsive incidence on UDP, and none observed on TCP, far below any commonly-scanned or commonly-open port.
- Exposure
- Bare IANA name registration, no protocol specification, and a near-zero nmap-services open-frequency (0.000362 udp / 0.000000 tcp) — a responding listener is anomalous and worth investigating rather than expected.
- IANA assignment
stx— "Stock IXChange"; reference (blank — no RFC cited in IANA registry); assignee Ferdi_Ladeira; modification date 2022-01-25; registration date blank; dual-registered 527/tcp + 527/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry stx 527/udp- Range class
- well-known (0–1023) [Confirmed]
- Prevalence
- nmap-services open-frequency 527/udp = 0.000362; 527/tcp = 0.000000 [Confirmed] — this site's own tooling (built from nmap-services)
- Related ports
- 527/tcp (same
stxregistration, same assignee and same 2022-01-25 modification date) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry stx 527/tcp
Primary use
no published protocol specification; IANA registry entry supplies only a name and description, no RFC
Other/unofficial uses
none found; no source consulted this pass documents any application on 527/udp beyond the bare registry assignment [Unknown]
Security implications
no CVE recorded in the NVD as of an August 2026 search; no confirmed malware association; near-zero real-world open incidence makes an open listener anomalous
Typically seen on
no confirmed deployment base identified; treat any live listener as anomalous [Unknown]
- Analyst note
- An open 527/udp has no confirmed legitimate service behind it — investigate as anomalous rather than assume routine infrastructure.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| stx | UDP | Stock IXChange | 0.04% |
| stx | TCP | Stock IXChange | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.