532
Summary
- // typical exposure
- Anomalous (rarely legitimately open) — netnews/readnews is obsolete pre-NNTP Usenet infrastructure with a measured nmap-services open-frequency of exactly 0 for the tcp side, so an open 532/tcp today is far more likely a stale relic or misconfiguration than legitimate, expected traffic.
- // analyst note
- An open 532/tcp is statistically near-absent (measured frequency 0) and tied to an obsolete pre-NNTP protocol — treat as a legacy relic or anomaly to investigate rather than expected traffic.
- // if you see it open
- No CVE or malware/trojan association is recorded for 532/tcp as of an August 2026 search. It is obsolete Usenet-era infrastructure with a measured open-frequency of 0 on tcp, so a live listener is more likely a relic, misconfiguration, or anomaly than an intentionally exposed service.
About port 532/tcp.
Port 532/tcp carries the IANA-registered netnews service (description "readnews"), a legacy Usenet news-reading protocol; it is not a service that belongs exposed to the public internet, and the measured evidence suggests it is essentially never seen open at all today.
The netnews/readnews name dates to the era before NNTP (RFC 977, port 119) standardized Usenet transport, and IANA carries the assignment dual-registered on both 532/tcp and 532/udp with a blank Reference field — no RFC is cited for the service. NNTP on port 119 became the dominant standard for news transfer and distribution, and mainstream use of port 532 diminished accordingly; today it is at most associated with legacy or internal news-distribution setups rather than active traffic.
Measured prevalence backs this up directly: the nmap-services open-frequency data bundled with this site records 532/tcp at exactly 0 (sampled, not observed open in the underlying scan corpus) and 532/udp at roughly 0.076%. No specific client or server software could be confirmed as commonly generating traffic on this port, so no application names are asserted here.
No CVE or malware/trojan association is recorded for port 532/tcp as of an August 2026 search, and no scanning or honeypot telemetry specific to this port surfaced either.
- Exposure
- netnews/readnews is obsolete, pre-NNTP Usenet infrastructure with a measured open-frequency of 0 for the tcp side — an open 532/tcp today is unusual and worth investigating rather than treating as routine.
- Malware/trojan association
- not listed as malware-associated in the sources reviewed as of an August 2026 search.
- Recommendation
- treat any live 532/tcp listener as a legacy relic, decoy, or misconfiguration rather than an intentional public-facing service; restrict to trusted/internal networks if the underlying application is still needed.
- IANA assignment
netnews— "readnews"; reference blank; assignee blank; dual-registered 532/tcp + 532/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netnews,532,tcp- Range class
- well-known (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netnews,532,tcp
- Prevalence
- nmap-services open-frequency 532/tcp = 0 (sampled, not observed open); 532/udp ≈ 0.000758 (~0.076%) [Confirmed] — this site's own tooling
- Related ports
- 119/tcp (NNTP, the protocol that superseded netnews/readnews for news transfer)
Primary use
legacy Usenet news-reading protocol (netnews/readnews), largely superseded by NNTP on port 119 — RFC 977 (March 1986) defined NNTP on 119, and 532 fell out of use from that point
Other/unofficial uses
none confirmed as of an August 2026 search [Unknown]
Security implications
no CVE or malware/trojan association recorded as of an August 2026 search; essentially unused today per measured prevalence
Typically seen on
legacy or internal Usenet news infrastructure, if present at all; otherwise an anomaly [Unknown]
- Analyst note
- An open 532/tcp is statistically near-absent (measured frequency 0) and tied to an obsolete pre-NNTP protocol — treat as a legacy relic or anomaly to investigate rather than expected traffic.
About port 532/udp.
Port 532/udp carries netnews, IANA's registered name for a "readnews" service; it has no legitimate modern use and should not be exposed to the public internet, since a responsive listener today is an anomaly rather than an expected service.
The port is registered with IANA under the service name netnews, description "readnews," and is dual-registered on both 532/tcp and 532/udp. The registry's Assignee and Reference fields are both blank — no RFC is cited for this assignment.
Available web sources describe netnews/readnews as a pre-NNTP mechanism for reading USENET news articles, predating the NNTP protocol (RFC 977, 1986) that later consolidated news reading and transfer onto port 119. Once NNTP became the standard, port 532 fell out of use — as one live port reference puts it, "NNTP won. Port 532 became irrelevant overnight."
No current, actively maintained software or vendor product was found using port 532/udp today, and no CVE or malware-family association specific to this port turned up in available sources. Nmap-services open-frequency data records 532/udp at roughly 0.076% and 532/tcp at exactly 0 — a sampled, not-observed-open reading rather than an absence of data.
- Exposure
- Essentially no legitimate modern service uses port 532/udp, so a responsive listener should be treated as anomalous rather than routine traffic.
- Historical role
- The
readnewsservice predates NNTP (RFC 977, 1986), which moved USENET news reading and transfer onto port 119, leaving 532 obsolete since the mid-1980s. - Malware
- No CVE or malware-family association specific to 532/udp is recorded in the sources checked as of an August 2026 search.
- Recommendation
- An open 532/udp on a modern host most likely indicates a legacy system, an unrelated application squatting on the port, or unauthorized software — investigate rather than assume normal use.
- IANA assignment
netnews— "readnews"; Reference (blank); Assignee (blank); dual-registered 532/tcp + 532/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netnews 532/udp- Range class
- well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry netnews 532/udp
- Prevalence
- nmap-services open-frequency 532/udp ≈ 0.000758 (~0.076%); 532/tcp = 0 (sampled, not observed open) [Confirmed] — this site's own tooling
- Related ports
- 119/tcp,udp (NNTP, the successor protocol) [Likely]
Primary use
pre-NNTP USENET news-reading service ("readnews"), predating RFC 977 (1986)
Other/unofficial uses
none identified; effectively obsolete since NNTP superseded it in the mid-1980s
Security implications
essentially never legitimately open today; no CVE or malware-family association found as of an August 2026 search
Typically seen on
legacy USENET-era hosts; otherwise an anomaly worth investigating
- Analyst note
- A listening port 532/udp is statistically rare and has no modern legitimate use — treat it as a legacy artifact, misconfiguration, or possible decoy/backdoor rather than expected traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| netnews | UDP | readnews | 0.08% |
| netnews | TCP | readnews | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.