Port 3135: PeerBook Port — Registered, Forgotten, Briefly Infamous

What Port 3135 Is

Port 3135 sits in the registered ports range (1024–49151). These ports are assigned by IANA upon application — someone fills out a form, names their service, and the port number is recorded in the registry.¹

For port 3135, that name is "PeerBook Port" (service label: peerbook-port), registered for both TCP and UDP.² PeerBook appears to have been a peer-to-peer application of some kind. Beyond the registry entry, it left almost no footprint — no RFC, no documentation, no community of users still running it. This happens. Port numbers get claimed, products never take off or quietly disappear, and the registry entry outlasts the service by years or decades.

The MyDoom Connection

Port 3135 has a more notable history than its official registration suggests.

In January 2004, the MyDoom worm arrived and became the fastest-spreading email worm ever recorded — at its peak, one in every ten emails on the Internet was a MyDoom infection.³ The worm installed a backdoor that opened TCP ports 3127 through 3198 on infected machines, creating a remote access channel for whoever launched the worm.

Port 3135 fell inside that range. It wasn't targeted specifically — MyDoom simply opened the entire block of 72 ports to ensure at least some would be reachable through firewalls. For a period in early 2004, traffic on port 3135 was a reliable indicator of a compromised Windows machine.

MyDoom's authors were never identified. The worm is believed to have been commissioned by email spammers to build a botnet for sending junk mail.⁴

If You See Traffic on Port 3135

There's no active legitimate service commonly running on this port. If you see it open on a machine, find out what's using it:

On Linux or macOS:

sudo lsof -i :3135
sudo ss -tlnp | grep 3135

On Windows:

netstat -aon | findstr :3135

Then match the PID to a process in Task Manager. If nothing on your system should be listening on this port, treat it as suspicious.

Why Unassigned-ish Ports Matter

The registered ports range was designed to bring order to the 1024–49151 space — a way to reduce port conflicts between applications. In practice, enforcement is loose. Applications use ports they never registered. Registered names like "PeerBook Port" sit in the registry long after the software stopped existing. And malware authors have always known that the registered range receives less scrutiny than well-known ports like 80 or 443.

Port 3135 is a small illustration of how the port number system works in reality: official registration is a record, not a guarantee. What matters is what's actually listening.