76
Summary
- // if you see it open
- No known CVEs and no documented active exploits or malware specifically targeting 76/tcp. SANS ISC reports a green threat level with no recorded attack campaigns. One third-party port database (auditmypc.com) carries a generic, unsubstantiated historical trojan/virus flag with no named malware family or verified incident — treated as a generic site-wide warning, not evidence of an active threat.
- // analyst note
- An open port 76 is statistically rare; legitimate DEOS use is essentially unobserved in modern deployments, so treat unexpected traffic as an anomaly to investigate rather than a normal service.
About port 76/tcp.
Port 76/tcp is registered with IANA as deos, described as "Distributed External Object Store," with both the assignee and contact listed as Robert Ullmann; the registry's Registration Date, Modification Date, and Reference columns are all blank — no RFC or specification document is cited, and none appears to have been published. The same name, description, and assignee are recorded for 76/udp, so the port is dual-registered across TCP and UDP. Beyond the bare registry line, DEOS left almost no public footprint: there is no widely deployed software, open-source implementation, or documented production use of the protocol, and it appears to be a legacy assignment that never achieved mainstream adoption. For an analyst the practical relevance of port 76 is its near-total absence from live traffic. The Nmap services frequency table records 76/tcp at roughly 0.000063, placing it among the rarest of well-known ports in internet-wide scan data, and the SANS Internet Storm Center shows a green threat level with no associated CVEs and no recorded attack campaigns. One third-party port database (auditmypc.com) carries a generic historical "trojan/virus" flag for the port, but names no malware family and cites no verified incident, so that claim is unsubstantiated and should be treated as a generic site-wide warning rather than evidence of an active threat. In practice a responsive port 76 is statistically unusual and worth investigating as an anomaly, but it is not a known active attack vector.
- IANA assignment
deos— "Distributed External Object Store"; reference (blank — no RFC cited in IANA registry); assignee and contact both Robert Ullmann; dual-registered 76/tcp + 76/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry lines 176–177; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt- Range class
- well-known (0–1023) [Confirmed] — port number 76 is within 0–1023
- Prevalence
- nmap-services open-frequency 76/tcp ≈ 0.000063 (extremely rare in internet-wide scans) [Confirmed] — https://svn.nmap.org/nmap/nmap-services
- Related ports
- 76/udp (identical DEOS registration) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry line 177
Primary use
name-based registration for DEOS, a distributed object-store service; no specification or RFC published, no documented production deployment
Other/unofficial uses
none documented
Common software
none identified; no widely deployed or open-source implementation documented
Security implications
no known CVEs and no documented active exploits or malware specifically targeting 76/tcp; SANS ISC reports a green threat level. A third-party database (auditmypc.com) carries a generic, unsubstantiated historical trojan/virus flag with no named malware or verified incident
Typically seen on
no characteristic host profile documented; a responsive port 76 is an anomaly worth investigating [Unknown]
- Analyst note
- An open port 76 is statistically rare; legitimate DEOS use is essentially unobserved in modern deployments, so treat unexpected traffic as an anomaly to investigate rather than a normal service.
About port 76/udp.
Port 76/udp is registered with IANA as deos with the description "Distributed External Object Store," assignee Robert Ullmann, and a blank reference field. The service is dual-registered on both transports: 76/tcp and 76/udp carry identical metadata in the IANA Service Name and Transport Protocol Port Number Registry. The IANA registry lists no registration date, no modification date, and no RFC reference for this entry — those columns are genuinely blank at the source, so they stay blank here rather than being invented. The protocol name "deos" appears in the historical Assigned Numbers document RFC 1700 (October 1994, since obsoleted by RFC 3232) as a registered service name, but no accompanying specification document exists: there is no RFC, draft, or vendor document that defines what a "Distributed External Object Store" wire protocol actually does. For an analyst, the practical picture is that this is a dormant legacy assignment. No active production software, open-source project, or vendor product has been identified that uses port 76 under the deos name, and the concept does not map to any widely documented system in use today. On the security side there are no CVEs tied specifically to 76/udp, no documented exploit frameworks, and no named malware family — a secondary port database (AuditMyPC) carries a generic historical "a Trojan or Virus has used this port in the past" flag while simultaneously reporting current status as "Virus / Trojan: No," and no specific threat family is named in any source found. No internet-wide scanning campaign or CISA/SANS ISC advisory for port 76 surfaced in the 2024–2026 search window. Because the port sits in the well-known range (0–1023) and carries an IANA name, some firewalls may pass it unchecked on the assumption it is legitimate traffic, but no documented attack chain abusing that assumption was found. Treat a responsive 76/udp as anomalous: no legitimate software is known to use it, so its presence is worth investigating rather than waving through.
- IANA assignment
deos— "Distributed External Object Store"; reference (blank — no RFC cited in IANA registry); assignee Robert Ullmann; dual-registered 76/tcp + 76/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.csv)- Range class
- well-known (0–1023) [Confirmed]
- Registration / modification date
- none recorded in the IANA registry (columns blank at source) [Confirmed] — IANA CSV
- Related ports
- the small/legacy well-known cluster of dual-registered low-number ports with blank references
Primary use
legacy IANA assignment for a "Distributed External Object Store"; no specification document and no active implementation known
Other/unofficial uses
none identified; no known production software, open-source project, or vendor product uses 76/udp under the deos name
Security implications
no CVEs, no documented exploit frameworks, no named malware family specific to 76/udp; only a generic historical "used by malware in the past" flag on a secondary database (AuditMyPC), which itself reports current status as not a virus/trojan; no scanning campaigns or CISA/SANS advisories found in the 2024–2026 window
Typically seen on
nothing in common practice; a responsive 76/udp is an anomaly worth investigating [Likely]
- Reference (RFC)
- none — IANA Reference column is blank [Confirmed] — IANA CSV
- Analyst note
- A dormant legacy assignment with no known active implementation. An open 76/udp is statistically rare; investigate rather than assume legitimate traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| deos | UDP | Distributed External Object Store | 0.07% |
| deos | TCP | Distributed External Object Store | 0.01% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.