530

Port 530/tcp carries a generic IANA "courier" RPC registration with no mainstream software documented as using it, so it should not be exposed to the public internet; an open 530/tcp is best treated as anomalous rather than expected.

IANA lists 530/tcp (and 530/udp, dual-registered) under the service name "courier" with description "rpc" — a generic Remote Procedure Call label rather than a specific protocol spec. No RFC or reference is cited, and no assignee or contact is listed.

This "courier" registration is unrelated to the Courier-IMAP mail server product, which uses separate, differently-numbered ports (143, 993). The name predates modern RPC frameworks such as DCOM, ONC RPC/portmap, or gRPC, and the registry does not tie it to any of them.

nmap-services measures 530/tcp open at a frequency of about 0.0013% across its scan corpus, versus about 0.087% for 530/udp — both low, with the udp side notably more common, consistent with sparse legacy probing rather than an actively deployed TCP service.

No specific vendor product, game, or peer-to-peer client could be documented as generating traffic on 530/tcp as of an August 2026 search. Nothing beyond the bare IANA courier / "rpc" label was found, so this entry makes no claim about what answers on the port.

Exposure

No mainstream RPC framework or application is documented as defaulting to port 530; an open 530/tcp is anomalous and worth investigating rather than treating as routine, as of an August 2026 search.

Common software

Unknown — no aggregator or vendor source reviewed names a specific application commonly using this port.

Prevalence

nmap-services records 530/tcp open at roughly 0.0013% of scanned hosts and 530/udp at roughly 0.087% — both rare.

IANA assignment

courier — "rpc"; reference (blank — no RFC cited); assignee not listed; dual-registered 530/tcp + 530/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry

Prevalence

nmap-services open-frequency 530/tcp ≈ 0.000013 (~0.0013%); 530/udp ≈ 0.000873 (~0.087%) [Confirmed] — this site's own tooling

Related ports

143/993 (Courier-IMAP mail server product — unrelated despite the shared "courier" name); other legacy RPC-registered ports

Primary use

generic RPC service-name registration ("courier"/"rpc"); not tied to a specific published protocol spec

Other/unofficial uses

Unknown — no vendor product, game, or P2P client documented as using this port as of an August 2026 search [Unknown]

Security implications

no CVE or malware association found as of an August 2026 search; low real-world prevalence makes an open instance anomalous

Typically seen on

Unknown — no documented deployment pattern found [Unknown]

Analyst note

An open 530/tcp has no documented legitimate software tied to it and is statistically rare — treat as anomalous and investigate rather than assume routine use.

Port 530/udp carries a service IANA registers as courier, described only as "rpc." No RFC, assignee, or additional protocol specification is cited, and no mainstream application, vendor product, game, or P2P client could be documented as generating traffic on this port as of an August 2026 search.

The IANA registry lists courier on both 530/tcp and 530/udp with the identical bare description "rpc," and blank Assignee and Reference fields. Beyond this registry line, no protocol document or usage writeup describing courier's exact behavior on 530/udp could be located, and no basis was found for tying it to any particular RPC framework (ONC RPC/portmap, DCOM, gRPC) or to a legacy-Unix deployment pattern — that inference is dropped from this entry as unsupported.

A search for named applications, games, or clients that generate traffic on 530/udp came back empty, as did a search for a CVE or confirmed malware association specific to this port, as of an August 2026 search. These are sourced abstentions rather than confirmed absences.

530/tcp, the dual-registered pair to this port, carries the identical registry facts — same service name, same bare "rpc" description, same blank Assignee/Reference. The only measured difference between the two transports is prevalence: nmap-services records 530/udp open at roughly 0.087% of scanned hosts versus roughly 0.0013% for 530/tcp. Neither figure supports inferring a distinct deployment base for either transport, so this entry aligns its exposure verdict with the 530/tcp sibling rather than asserting a divergent posture with no evidence behind it.

Exposure

Anomalous — no mainstream software is documented as using port 530/udp; an open instance should be treated as anomalous and investigated rather than assumed to be routine infrastructure, as of an August 2026 search.

Registry gap

IANA cites no RFC and no assignee for this entry, so there is no formal specification to confirm courier's exact protocol behavior beyond the description "rpc" (the IANA Service Name and Transport Protocol Port Number Registry courier 530/udp).

CVE/malware

No CVE specific to 530/udp is recorded in the NVD, and no malware/trojan association could be independently confirmed, as of an August 2026 search.

Scanning context

UDP scanning is slower and less reliable than TCP scanning, but remains a known technique for enumerating exposed legacy RPC-labeled services (https://nmap.org/book/scan-methods-udp-scan.html).

Transport note

530/tcp carries an identical courier/"rpc" registration and is also graded Anomalous; the only measured difference between the pair is prevalence (udp ~0.087% vs tcp ~0.0013%), which is not evidence of a distinct deployment pattern on either side.

IANA assignment

courier — description "rpc"; assignee blank; reference blank; dual-registered 530/tcp + 530/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry courier 530/udp

Range class

well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry courier 530/udp

Prevalence

nmap-services open-frequency 530/udp ≈ 0.000873 (~0.087%); 530/tcp ≈ 0.000013 (~0.0013%) [Confirmed] — this site's own tooling

Related ports

530/tcp (dual registration, identical service name and description "rpc"; also graded Anomalous exposure) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry courier 530/tcp

Primary use

registered with IANA as courier with description "rpc"; no RFC or public protocol document describing courier's exact semantics was found, and no basis exists to tie it to a specific RPC framework or host type

Other/unofficial uses

none documented as of an August 2026 search [Unknown]

Security implications

no CVE recorded in the NVD and no malware/trojan association confirmed as of an August 2026 search; no mainstream software documented as using this port, so an open instance is treated as anomalous rather than expected

Typically seen on

none documented — the prior "legacy Unix/RPC-capable hosts" inference is dropped as unsupported by the registry description [Unknown]

Analyst note

An open 530/udp has no documented legitimate software tied to it and, like its 530/tcp pair, should be treated as anomalous; confirm via RPC/version enumeration rather than assuming either a public-facing application or a legacy-Unix deployment.