Port 2041: Unclaimed — A database, a chat app, and a worm walk into a port

What Range This Port Belongs To

Port 2041 sits in the registered ports range (1024-49151). These ports are managed by IANA, which maintains the official registry of which application gets which port. But "registered" doesn't mean every port in this range has a tenant. Thousands are unassigned — officially empty, waiting.

Unassigned registered ports are neither forbidden nor free. Nothing stops an application from using them. Nothing guarantees the port will be available. And nothing prevents two applications from independently deciding this port looks useful.

Port 2041 illustrates exactly what happens in that vacuum.

Unofficial Uses

Interbase

Some port databases list port 2041 as associated with Interbase, the Borland database engine that was open-sourced in 2000 and eventually became Firebird. The association appears to come from Nmap's service fingerprinting data rather than any official IANA assignment. Interbase primarily uses port 3050 — the 2041 connection is observed rather than official.¹

Mail.Ru Agent (MRIM)

Mail.Ru Agent was a Russian instant messenger launched in 2004, built on a proprietary protocol called MRIM (Mail.Ru Instant Messenger). At its peak it had tens of millions of users in Russia and Eastern Europe. The client used port 2041 for its communications — unencrypted, unofficial, and unregistered. Mail.Ru Agent was officially discontinued in 2019.²

W32.Korgo / Padobot Worm

In May 2004 — the same year Mail.Ru Agent launched — a network worm called Korgo (also known as Padobot) began spreading by exploiting the Microsoft LSASS vulnerability documented in MS04-011. Korgo was written by the Russian Hangup Team and spread by attacking random IP addresses on port 445.

Once installed, it opened a backdoor and listened on TCP port 2041. Security researchers noted something unusual in their writeups: the worm listened here "due to a bug in the code." The malware authors made an error, and port 2041 became the permanent fingerprint of their infection — a mistake baked into every variant.³

If you see unexpected traffic on port 2041 on a Windows machine from that era, Korgo is the first thing to check.

How to Check What's Listening on This Port

macOS / Linux:

sudo lsof -i :2041

Linux (alternative):

sudo ss -tlnp sport = :2041

Windows:

netstat -ano | findstr :2041

The process ID in the output can be cross-referenced in Task Manager (Windows) or ps aux (macOS/Linux) to identify exactly what has claimed the port.

Why Unassigned Ports Matter

The port space has 65,535 slots. The well-known ports (0-1023) are densely assigned — almost every number has an official owner. The registered range is sparsely populated. Thousands of numbers sit empty, and that emptiness does real work.

When developers need a port for a new service, the unassigned registered range is where they look. When applications want to avoid conflicts, they request a formal registration from IANA. When they don't bother registering, they pick something that looks unused and hope for the best.

Port 2041's history — a database, a chat app, and a bug-ridden worm, all independently deciding this number was available — is what the unregistered registered range looks like in practice.