Port 3721: Xsync — Registered, Rarely Seen

What Range This Port Belongs To

Port 3721 sits in the registered port range (1024–49151). These ports are administered by IANA — any software vendor can apply to claim a number, and IANA will record it in the official registry. Registered doesn't mean active. It means someone filed the paperwork.

The well-known ports (0–1023) carry the Internet's foundational protocols: HTTP, SSH, DNS, SMTP. The registered range is where everything else lives — enterprise software, custom protocols, game servers, and thousands of names that time has forgotten.

The Official Assignment: Xsync

IANA lists port 3721 as assigned to Xsync on both TCP and UDP. ¹

Xsync doesn't appear in any widely used software. There are no active RFCs, no open-source implementations anyone references, no community of users who rely on it. The registration exists, but whatever Xsync was meant to be never achieved meaningful adoption.

This is common in the registered range. Ports get claimed, projects stall, companies fold, and the number sits quietly on the books.

Known Unofficial Uses

Two things have been observed running on port 3721 in the wild:

ES File Explorer (Android) — The popular Android file manager uses port 3721 when its built-in FTP server is active. This was also the port at the center of a 2019 security disclosure: ES File Explorer exposed an HTTP server on this port that allowed any app on the local network to read files from the device. ²

Security flags — Port scanning databases flag 3721 as a port associated with trojan activity. The specific trojan noted in older databases is not well-documented and likely refers to opportunistic use rather than a purpose-built backdoor. Attackers frequently use unassigned or obscure registered ports precisely because they're less monitored. If port 3721 appears in your firewall logs from an unexpected source, investigate. ³

A Footnote on the Number

The number 3721 carries a specific gravity in Chinese Internet history that has nothing to do with this port.

3721.com was a Chinese company founded in 1998 by Zhou Hongyi that sold "Internet keywords" — type a Chinese phrase into your browser address bar, and their plugin would redirect you to a partner site. The software was a Browser Helper Object for Internet Explorer, and it was extraordinarily aggressive. It was nearly impossible to uninstall. If you killed it in Task Manager, a sibling process would immediately restart it. Microsoft's AntiSpyware flagged it as spyware. Chinese security researchers called it "rogue software." It was eventually named one of China's top ten malicious applications. ⁴

Yahoo acquired Beijing 3721 Technology in 2003 for $120 million, rebranding the product as Yahoo Assistant. The controversy followed.

The port and the company are unrelated — 3721.com didn't operate on port 3721 in any notable way. But the number itself carries a reputation in certain circles, which makes its presence in the registry feel oddly appropriate for something nobody uses.

How to Check What's Listening on This Port

If port 3721 appears on your system or in your logs, find out what's using it:

macOS / Linux:

# See what process is listening on port 3721
sudo lsof -i :3721

# Alternative with netstat
sudo netstat -tlnp | grep 3721

Windows:

# Find process using port 3721
netstat -ano | findstr :3721

# Get the process name from the PID
tasklist | findstr <PID>

If something is listening and you don't recognize it, cross-reference the process name against your installed software. ES File Explorer on a mobile-connected device is the most common legitimate explanation. Anything else warrants scrutiny.

Why Unassigned Ports Matter

The registered range exists to prevent collisions. Without it, two different applications might both try to use port 3721, and they'd conflict. Registration is a coordination mechanism — a way of saying "we're using this number, please use a different one."

The system works when people follow it. It breaks down when registrations go stale (as with Xsync), when software uses ports without registering (common), or when attackers deliberately use obscure ports to evade monitoring.

Port 3721 is a minor case study in all three: an official registration that means nothing in practice, an Android app that claimed the port informally, and enough trojan associations to keep security teams alert.