{
  "port": 1025,
  "protocol": "tcp",
  "service": "Windows dynamic RPC endpoint — IANA: blackjack",
  "oneLiner": "Registered as \"network blackjack\", but the reason it is so often open is Windows: the first dynamic RPC port on older releases.",
  "whatItIs": "IANA's assignment is blackjack, a joke-grade legacy registration with no specification behind it. The reason 1025 is by far the most frequently open port in this neighbourhood in nmap's data is Microsoft: on Windows 2000, XP and Server 2003 the default dynamic port range ran 1025–5000, so the first service to ask the RPC endpoint mapper for a port landed on 1025 — which is why scanners label it \"NFS-or-IIS\". Windows Vista and Server 2008 moved the range to 49152–65535, so on a current host a listening 1025 is more likely an application that chose it.",
  "exposure": {
    "verdict": "never",
    "note": "As a Windows RPC endpoint this is a broadly-capable interface with a long history of remotely-exploitable bugs, and it is under constant untargeted scanning. RPC does not belong on the internet; reach it over a VPN."
  },
  "checkCommand": "nc -vz -w 3 TARGET 1025",
  "links": [
    {
      "title": "Microsoft — Service overview and network port requirements (dynamic range 1025–5000 on pre-Vista Windows)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 1025",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1025",
      "kind": "iana"
    },
    {
      "title": "nmap-services (1025/tcp NFS-or-IIS | blackjack)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "blackjack"
}