Port 473: Hybrid-Pop — The Ghost Protocol

Port 473 sits in the well-known ports range (0-1023), officially assigned by IANA to a service called "hybrid-pop." But here's the strange part: nobody seems to know what hybrid-pop actually is.

The Mystery of Hybrid-Pop

The IANA registry lists port 473 for both TCP and UDP, assigned to "hybrid-pop."¹ That's where the trail goes cold. No RFC defines it. No technical documentation explains it. No active software uses it. The name suggests some connection to POP (Post Office Protocol), the email retrieval system, but no hybrid variant of POP appears in any email protocol history.²

This is a ghost protocol—officially registered but functionally extinct, if it ever lived at all.

What Actually Uses Port 473

In practice, port 473's main historical distinction is malware. Security databases from the 2010s flagged this port as associated with trojans and viruses that used it for command-and-control communication.³ The port became more notable for what exploited it than for its intended purpose.

Some older router implementations also had issues where creating a VPN client account would permanently open port 473 to the WAN, even when disabled—a security vulnerability rather than a feature.⁴

Why This Port Matters

Port 473 represents something genuinely strange in the Internet's infrastructure: an officially assigned well-known port with no known legitimate use. Someone, somewhere, at some point registered "hybrid-pop" with IANA. The registration was approved. The port was assigned. And then... nothing.

The well-known ports range (0-1023) is supposed to be reserved for established, standardized services. Port 473 got in, but the service never materialized.

Checking What's Listening

To see if anything is using port 473 on your system:

Linux/Mac:

sudo lsof -i :473
sudo netstat -an | grep 473

Windows:

netstat -ano | findstr :473

If something is listening on port 473, it's either a very unusual piece of software or something worth investigating.

The Forgotten Service

Port 473 is a reminder that not every port assignment becomes part of the Internet's living infrastructure. Some services were proposed, registered, and abandoned. Some were implemented in software that disappeared. Some, like hybrid-pop, leave almost no trace at all.

The port exists. The name exists in the registry. But the protocol itself? A ghost.

Related Ports

• Port 110 — POP3, the actual Post Office Protocol for email retrieval
• Port 995 — POP3S, POP3 over TLS/SSL
• Port 143 — IMAP, the more modern email protocol