Port 1930: Drive AppServer — A Registered Port Nobody Remembers

Port 1930 sits in the registered port range (1024-49151), which means IANA has assigned it an official service name. That name is driveappserver — Drive AppServer — registered by someone at bliss-support.demon.co.uk, a UK support company whose domain no longer resolves.

The registration is permanent. The company is not.

What "Registered Port" Means

The registered port range spans 1024 to 49151. Any developer or organization can apply to IANA to claim a port number for their application. There is no expiration. There is no reclamation process when the software is abandoned.

This creates a peculiar situation: thousands of ports in this range are registered to software that no longer exists, companies that have dissolved, or protocols that never gained traction. Port 1930 is one of them.¹

Who Uses It Now

Without an active, widely deployed service on port 1930, the port has mostly been claimed by silence — and occasionally by malware.

W32.Spybot.IVQ is a worm documented by Symantec that uses port 1930 as one of several possible backdoor ports. It spreads through network shares and servers with weak passwords, then opens listening ports (1927, 1930, 5002, 5003) for remote command and control.²

This is a common pattern: abandoned registered ports make useful hiding spots. A firewall rule that allows traffic on a "legitimate" registered port number is less likely to raise flags than traffic on a completely unknown one.

How to Check What's Listening

If you see traffic on port 1930, check what's actually using it:

macOS / Linux:

lsof -i :1930

Windows:

netstat -ano | findstr :1930

Then cross-reference the process ID with your process list. If you don't recognize it, that's worth investigating.

Why This Matters

The registered port range is a graveyard of good intentions. Software gets written, ports get registered, companies disappear — but the assignments stay. This matters because:

• Security tools that trust registered ports over unregistered ones can be fooled
• Network monitoring that flags "unknown" ports may miss traffic on registered-but-abandoned ones
• Malware authors know this, and choose their ports accordingly

Port 1930 is a small lesson in how the Internet's infrastructure accumulates history. The registry remembers everything. The people who built things don't always stick around.