Port 1966: Unassigned — A quiet number with a brief, shadowy past

Port 1966 belongs to the registered port range (1024–49151). These are ports that organizations can formally register with IANA for specific services — but registration is optional, and thousands of numbers in this range simply go unclaimed. Port 1966 is one of them.

IANA lists no assigned service for port 1966. Some port databases list an informal name, "Slush," but this appears in no RFC, no official documentation, and no widely deployed software. It's a label without a referent.¹

The Malware Chapter

Port 1966 has one footnote worth knowing: a trojan called Fake FTP.

In the late 1990s and early 2000s, a category of malware worked by installing covert FTP servers on compromised machines. Fake FTP was one of these. It would open a listening port — port 1966 among others — giving an attacker file-transfer access to the victim's system. The name was almost honest about what it was.

This doesn't mean port 1966 is dangerous today. Malware uses whatever port is convenient and unblocked. The association is historical, not structural. If you see port 1966 open on a system you manage, the question is the same as with any unexpected open port: what process opened it, and why?²

How to Check What's Listening

On Linux or macOS:

ss -tlnp | grep 1966
# or
lsof -i :1966

On Windows:

netstat -ano | findstr :1966

These commands will show you the process ID (PID) holding the port open. From there, you can identify the application and decide whether it should be there.

Why Unassigned Ports Matter

The port numbering system works because assignments create expectations. When port 443 is open, you expect HTTPS. When port 22 is open, you expect SSH. Unassigned ports carry no such expectation — which is precisely why malware has historically favored them.

An open unassigned port is a question without a context clue. Something is listening. But what? That ambiguity is the point. Firewalls and intrusion detection systems are better at blocking known-bad than detecting unknown-suspicious.

Port 1966 is a reminder that the gaps in the numbering system aren't neutral. Silence can be occupied.