Registered as "network blackjack", but the reason it is so often open is Windows: the first dynamic RPC port on older releases.
IANA's assignment is blackjack, a joke-grade legacy registration with no specification behind it. The reason 1025 is by far the most frequently open port in this neighbourhood in nmap's data is Microsoft: on Windows 2000, XP and Server 2003 the default dynamic port range ran 1025–5000, so the first service to ask the RPC endpoint mapper for a port landed on 1025 — which is why scanners label it "NFS-or-IIS". Windows Vista and Server 2008 moved the range to 49152–65535, so on a current host a listening 1025 is more likely an application that chose it.
Do not expose
As a Windows RPC endpoint this is a broadly-capable interface with a long history of remotely-exploitable bugs, and it is under constant untargeted scanning. RPC does not belong on the internet; reach it over a VPN.
$ nc -vz -w 3 TARGET 1025Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.