Port 785: Unassigned — A Ghost in the Well-Known Range

Port 785 occupies a strange position in the Internet's addressing system. It sits in the well-known port range—the first 1,024 ports (0-1023) reserved for system services and assigned by IANA—but it has never been given an official assignment.¹

What "Unassigned" Means

The well-known port range is valuable real estate. These ports require root or administrator privileges to use on most systems. They're where you find SSH (22), HTTP (80), HTTPS (443)—the infrastructure services that keep the Internet running.

Port 785 is reserved but unclaimed. IANA has never assigned it to any protocol or service. It's like a reserved parking space that's never been filled.

The Only Known Use: NetworkTerrorist

The only documented use of port 785 is not official—it's malicious. Security databases from the early 2000s list port 785 as associated with "NetworkTerrorist," a trojan that would listen on this port for remote commands.²

This is the pattern for many unassigned ports: if there's no legitimate service using them, sometimes malware fills the gap. Trojans and backdoors often choose unassigned well-known ports specifically because system administrators might not expect traffic there.

Why Unassigned Ports Matter

Every unassigned port in the well-known range represents both an opportunity and a risk:

Opportunity: IANA can assign it to a new protocol that needs a privileged port. As the Internet evolves, new system-level services emerge that need official addresses.

Risk: Unassigned ports can be exploited by malware precisely because they're not expected to have traffic. If you see traffic on port 785, it's worth investigating—there's no legitimate service that should be using it.

Checking What's Listening

To see if anything is listening on port 785 on your system:

Linux/macOS:

sudo lsof -i :785
# or
sudo netstat -tuln | grep :785

Windows:

netstat -ano | findstr :785

If you find something listening on port 785 and you didn't deliberately configure it, investigate. There's no official service that belongs there.

The Broader Picture

Port 785 is one of many unassigned ports in the well-known range. As of 2026, roughly half of the well-known ports remain unassigned—space held in reserve for future protocols we haven't invented yet, or simply never needed to formalize.

These empty spaces matter. They're how the Internet maintains flexibility to evolve. They're also reminders that not every number between 0 and 1023 carries something meaningful. Some are just waiting.