Port 3028: LiebDevMgmt_DM — The Ghost Registration

What Port 3028 Is

Port 3028 sits in the registered port range (1024–49151). These ports are managed by IANA, the Internet Assigned Numbers Authority, which maintains a registry of port-to-service assignments. The idea is that if a company or protocol wants a consistent, well-known port, they register it — and that port is then "taken."

Port 3028 is registered. Its official IANA entry reads: LiebDevMgmt_DM, assigned for both TCP and UDP.¹

That's where the documentation ends.

LiebDevMgmt_DM

Nobody seems to know what LiebDevMgmt_DM is. Searching for "Lieb Device Management" turns up port database entries that echo each other, none tracing back to original documentation, a vendor website, or deployed software. The registration exists. The registrant does not appear to have left a footprint.

This is more common than you'd think. The IANA registry was built on good intentions — a namespace for the Internet's services. But registrations don't expire, don't require proof of deployment, and outlast the companies and projects that filed them. LiebDevMgmt_DM is a name in a database, pointing at nothing.

The Wortbot Connection

Port 3028 has one clear historical footnote: Backdoor.Wortbot, a trojan documented by Symantec in February 2005.² Wortbot opened a listener on TCP port 3028 to allow remote access to infected Windows machines — a classic backdoor pattern.

Wortbot is old, long since covered by antivirus signatures. But its association with this port means 3028 occasionally still attracts scanner traffic from automated tools sweeping for legacy vulnerabilities.³

How to Check What's Using This Port

If you see port 3028 active on a system, find out what's listening:

macOS / Linux:

sudo lsof -i :3028
sudo ss -tlnp | grep 3028

Windows:

netstat -ano | findstr :3028
tasklist /FI "PID eq <pid>"

Substitute the PID from the first command into the second to identify the process. If nothing you recognize is using this port, investigate before assuming it's benign.

Why Ghost Registrations Matter

The registered port range has 48,127 slots. Many are in active use by well-known software. Many others are like port 3028 — registered once, never widely deployed, occupying namespace in perpetuity.

This matters because developers choosing ports for new applications often avoid registered ports out of respect for the registry, even when those registrations are effectively dead. The ghost registrations quietly shrink the practical space for new legitimate uses.

It also matters for security: an unrecognized service name on an active port shouldn't be dismissed because it has an official-sounding IANA entry. LiebDevMgmt_DM is a name with no software behind it. Something else is always what's actually running.

Summary