82

Port 82/tcp is registered with IANA under the service name xfer, described as "XFER Utility," with both assignee and contact listed as Thomas M. Smith and a blank reference field; the assignment is dual-registered identically on TCP and UDP. The IANA registry carries no registration date, no modification date, and no RFC or public specification for the entry — the underlying "XFER Utility" protocol has never been publicly disclosed, so the registration is essentially a name reservation with no documented wire behavior. For an analyst this means there is no legitimate, widely deployed service that "owns" port 82, and what shows up on the port in practice is almost entirely incidental. The most common real-world use is as an alternate HTTP port: administrators run secondary web servers or admin interfaces on 82 when port 80 is already bound or filtered. Historically, the Torpark portable privacy browser (Hacktivismo, 2006) used port 82 for control communications, and the W32/Netsky email worm family (circa 2004) included a variant that opened a backdoor listening on TCP 82 to save and execute any executable it received. Because no mainstream legitimate service occupies the port, security scanners tend to flag a responsive port 82 as suspicious, and the SANS Internet Storm Center records sustained background scanning against it — consistent with broad internet-wide reconnaissance rather than a targeted exploitation campaign. Port 82 sits in the well-known range (0–1023), so binding it on Unix systems historically required root/administrator privileges.

IANA assignment

xfer — "XFER Utility"; assignee and contact Thomas M. Smith; reference blank (no RFC in registry); dual-registered 82/tcp + 82/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry (lines 232 tcp / 233 udp); https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=82

Registration / modification date

none recorded in the IANA registry (columns blank) [Confirmed] — IANA service-names registry

Range class

well-known (0–1023); binding historically requires root/admin on Unix [Confirmed] — IANA port-number ranges

Related ports

alternate-HTTP cluster (81, 83, 8080, 8000)

Primary use

name reservation only — the "XFER Utility" protocol is undisclosed and undeployed; in practice port 82 is most often an alternate HTTP port for secondary web servers / admin interfaces

Other/unofficial uses

Torpark portable privacy browser (Hacktivismo, 2006) used port 82 for control communications; informal secondary/development HTTP servers

Security implications

W32/Netsky worm variant (circa 2004) opened a backdoor listening on TCP 82 that saved and executed received executables; an open port 82 is treated as suspicious by scanners since no mainstream service uses it

Exposure / scanning

SANS ISC records ongoing opportunistic scanning of port 82 (single-source daily attempt counts in the hundreds to low thousands as of mid-2026); pattern is broad reconnaissance, not a documented targeted campaign

Typically seen on

incidental alternate-HTTP hosts; otherwise an anomaly worth investigating

Analyst note

There is no authoritative protocol behind the IANA xfer registration, so a responsive port 82 should be characterized from what it actually serves (commonly a secondary web interface), and an unexplained listener treated as suspect given the Netsky backdoor history.

Port 82/udp is registered with IANA as xfer with the description "XFER Utility," assignee Thomas M. Smith, and a blank reference field (dual-registered on TCP and UDP — port 82/tcp carries an identical entry). The "XFER Utility" is a proprietary file-transfer helper; the underlying wire protocol has never been publicly disclosed and no RFC defines it, so the IANA reference field is genuinely blank rather than omitted. The assignment carries no registration date or modification date in the public registry, and the assignee contact is recorded under the same handle as the assignee. For an analyst, port 82/udp matters mainly because there is no legitimate mainstream public software that uses it in normal operation: a responsive 82/udp is therefore statistically unusual and worth investigating rather than a benign default service. Historically documented associations are sparse and primarily TCP-side, since the two share the port: SANS Internet Storm Center notes link port 82 to the W32/Netsky-X worm backdoor component (noted 2007-07-16) and to Microspot.co.uk product-registration traffic (noted 2008-04-29) — neither is a normal, sanctioned UDP use, and the worm note in particular is the kind of anomaly an analyst is more likely to encounter than the registered XFER Utility itself. Current threat posture at SANS ISC is green (low), but active scan traffic against port 82 is observed (a recent sample day showed a top source sending ~4,147 attempts), consistent with opportunistic internet-wide scanning rather than targeted exploitation. The protocol offers no modern encryption or authentication standard, so the standing guidance is to keep port 82 closed on public-facing firewalls unless a specific need requires it, and to treat an unexpected open 82/udp as anomalous.

IANA assignment

xfer — "XFER Utility"; reference (blank — no RFC cited in IANA registry); assignee Thomas M. Smith; dual-registered 82/tcp + 82/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry line 233; tcp on line 232)

Range class

well-known (0–1023) [Confirmed]

Registration date

not recorded in the public IANA entry (blank — not fabricated) [Confirmed] — IANA registry

Modification date

not recorded in the public IANA entry (blank) [Confirmed] — IANA registry

Related ports

shares its number with 82/tcp (identical xfer registration)

Primary use

proprietary "XFER Utility" file-transfer helper; protocol undocumented, no public specification

Other/unofficial uses

no widely deployed legitimate public software on 82/udp; historical (shared-port, primarily TCP) associations — W32/Netsky-X worm backdoor component (SANS ISC note 2007-07-16) and Microspot.co.uk product-registration traffic (SANS ISC note 2008-04-29)

Security implications

SANS ISC threat level green (low); opportunistic scanning observed (~4,147 attempts from a top source on a recent sample day); no modern encryption/authentication standard; keep port 82 closed on public firewalls unless explicitly required

Typically seen on

not a normal default service; an open 82/udp should be treated as anomalous and investigated

Analyst note

Because the registered protocol is proprietary and undocumented and no mainstream software uses 82/udp, a responsive port should be treated as anomalous — investigate as a possible worm backdoor remnant, decoy, or misconfiguration rather than a sanctioned service.