{
  "port": 31337,
  "protocol": "both",
  "service": "eldim (IANA) / \"elite\" backdoor port",
  "oneLiner": "Leetspeak for \"eleet\" — the traditional backdoor port, and since registered to the eldim upload proxy.",
  "whatItIs": "31337 spells ELEET in leetspeak, which is why a generation of backdoors and joke services chose it; Nmap still names 31337/udp BackOrifice after the Cult of the Dead Cow remote-administration tool and names 31337/tcp \"Elite\". IANA has since registered both the TCP and UDP entries to eldim, an open-source file-upload proxy that encrypts uploads before pushing them to object storage. The number also lands inside Kubernetes' default NodePort range, so clusters allocate it by accident. In short: nothing legitimate listens here by convention, and an unexplained 31337 is worth identifying rather than assuming.",
  "exposure": {
    "verdict": "careful",
    "note": "eldim is designed to face the internet over HTTPS, so the port itself is not the problem — but an unexpected 31337 on a host you did not configure is an incident-response question, not a firewall question."
  },
  "checkCommand": "nc -vz -w 3 TARGET 31337",
  "links": [
    {
      "title": "IANA port registry — 31337 (eldim)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=31337",
      "kind": "iana"
    },
    {
      "title": "eldim — a secure file upload proxy",
      "url": "https://github.com/daknob/eldim",
      "kind": "github"
    },
    {
      "title": "nmap-services — Nmap's port frequency and name table",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}