# WHATPORT(31337)

## NAME

port 31337 — eldim (IANA) / "elite" backdoor port — Leetspeak for "eleet" — the traditional backdoor port, and since registered to the eldim upload proxy.

Protocol: TCP/UDP  
IANA registry

## DESCRIPTION

31337 spells ELEET in leetspeak, which is why a generation of backdoors and joke services chose it; Nmap still names 31337/udp BackOrifice after the Cult of the Dead Cow remote-administration tool and names 31337/tcp "Elite". IANA has since registered both the TCP and UDP entries to eldim, an open-source file-upload proxy that encrypts uploads before pushing them to object storage. The number also lands inside Kubernetes' default NodePort range, so clusters allocate it by accident. In short: nothing legitimate listens here by convention, and an unexplained 31337 is worth identifying rather than assuming.

## EXPOSURE

**Expose with care.** eldim is designed to face the internet over HTTPS, so the port itself is not the problem — but an unexpected 31337 on a host you did not configure is an incident-response question, not a firewall question.

## CHECK

```sh
nc -vz -w 3 TARGET 31337
```

## SEE ALSO

- iana — [IANA port registry — 31337 (eldim)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=31337) (iana.org)
- source — [eldim — a secure file upload proxy](https://github.com/daknob/eldim) (github.com)
- source — [nmap-services — Nmap's port frequency and name table](https://github.com/nmap/nmap/blob/master/nmap-services) (github.com)

---

HTML: <https://whatport.net/31337/> · JSON: <https://whatport.net/31337.json> · full dataset: <https://whatport.net/ports.json>