Port 1245: Unassigned — The VooDoo Doll's backdoor

Port 1245 sits in the registered port range (1024-49151), where applications are supposed to request official assignments from IANA. But this port has no current legitimate service registered to it.

What it does have is a past.

The VooDoo Doll Era

In the late 1990s, port 1245 was the communication channel for VooDoo Doll, a remote access trojan that infected Windows 95 and Windows 98 machines.¹² If this port was open on your computer, you weren't the only one using it.

This was the era when trojans with names like Back Orifice, NetBus, and SubSeven demonstrated just how vulnerable desktop operating systems were to remote control. VooDoo Doll was part of that wave—malware that didn't ask IANA for permission, didn't file paperwork, just took a port number and used it.³

The trojan is long dead. Modern operating systems, firewalls, and antivirus software made these simple backdoors obsolete decades ago. But the port number remains, technically unassigned, carrying the memory of what once ran there.

The Registered Port Range

Port 1245 belongs to the registered port range: ports 1024 through 49151. This range was created so that applications could request official port assignments from IANA without needing the elevated privileges required for well-known ports (0-1023).

The theory: developers build an application, request a port number, IANA assigns it, everyone knows what runs where. The reality: anyone can use any port. IANA assignments are more like suggestions than enforcement. VooDoo Doll proved that in the worst way possible.

Today, this range contains thousands of registered services—databases, monitoring tools, games, corporate software. It also contains thousands of unassigned ports like 1245, available for anyone to use for anything.

What Runs Here Now

Nothing officially. An unassigned registered port can be used by:

• Custom applications that need a network port and pick an available number
• Internal tools that will never be public-facing or need IANA registration
• Malware (still, though rarely as blatantly as the 1990s)
• Nothing at all on most systems

To check if something is listening on port 1245 on your system:

Linux/macOS:

sudo lsof -i :1245
# or
sudo netstat -tulpn | grep 1245

Windows:

netstat -ano | findstr :1245

If you see a process listening on this port and don't recognize it, investigate. It's almost certainly not VooDoo Doll anymore, but the principle remains: unexpected listeners deserve scrutiny.

Why Unassigned Ports Matter

The Internet has 65,535 ports per protocol (TCP and UDP). Only a fraction are assigned to well-known services. The rest—including port 1245—are the working space where applications can operate without stepping on each other's toes.

Unassigned ports aren't failures of organization. They're availability. They're flexibility. They're the reason your development server can run on port 3000 and your database on port 5432 and your custom monitoring tool on whatever port you picked, all without conflict.

But that flexibility cuts both ways. VooDoo Doll didn't need permission to use port 1245. Neither does anything else. The port is just a number. What matters is what listens behind it.