Port 3526: starQuiz Port — A registered ghost

What Port 3526 Is

Port 3526 sits in the registered ports range (1024-49151), the middle tier of the port number space. IANA maintains this range for services that have formally requested a port assignment — applications that wanted a consistent, predictable home in the port numbering system.

According to IANA's registry, port 3526 was registered in June 2002 for a service called starQuiz Port (starquiz-port), assigned on both TCP and UDP.¹

That is essentially everything that is known about it.

The Ghost Problem

starQuiz — whatever it was — left almost no trace. No documentation, no surviving software, no forum threads, no archived websites. A quiz application that presumably needed a stable port to function, registered its claim with IANA, and then disappeared into the early 2000s Internet.

This is more common than it sounds. IANA's registry doesn't expire. A port registration from 2002 sits in the same list as one from 2024. The registry has no mechanism to reclaim ports from defunct services, so assignments accumulate over decades, some pointing at thriving protocols and some pointing at nothing.

Port 3526 belongs to the second category: officially occupied, practically empty.

What You Might Find Here

If you see traffic on port 3526, it isn't starQuiz. It's one of several possibilities:

• A developer using it opportunistically — registered ports that aren't actively used by known software are convenient picks for custom applications and internal tools
• Malware — attackers sometimes use obscure registered ports as command-and-control channels precisely because they don't trigger obvious alarms
• Ephemeral client traffic — operating systems sometimes use registered ports as temporary source ports for outbound connections, though they prefer the dynamic range (49152-65535)

None of these are expected. If you see consistent traffic on 3526, it warrants investigation.

How to Check What's Listening

On Linux or macOS:

# Show what process is listening on port 3526
ss -tlnp | grep 3526

# Alternative using lsof
lsof -i :3526

On Windows:

netstat -ano | findstr :3526

The process ID returned can be cross-referenced with Task Manager or tasklist to identify the application.

Remotely (from another machine):

# Check if the port is open
nc -zv <hostname> 3526

# Or with nmap for more detail
nmap -p 3526 <hostname>

Why Unassigned Ports Matter

The port numbering system only works because of shared convention. When a service claims port 443, everyone agrees that's HTTPS. When something runs on an unexpected port, it's either breaking convention, hiding, or operating in genuinely private territory.

Ports like 3526 — technically registered, practically unoccupied — are the gray zones. The registration means something once claimed this address. The silence means no one does anymore.

The Internet has 65,535 ports. A surprising number of them are tombs.