IANA has nothing here; the recurring real-world sighting is a Check Point embedded appliance's HTTPS admin interface.
981 falls inside IANA's unassigned 954–988 block, so there is no registered service name, and nmap's service table lists it as unknown. The use that keeps turning up on scans is remote HTTPS management on Check Point's SofaWare-derived embedded firewalls — the Safe@Office and UTM-1 Edge line — which publish their web administration UI here instead of on 443. Beyond that, 981 is whatever a local admin decided to put on it. A TLS handshake usually settles the question, because the certificate names the device.
Do not expose
If it is the appliance management UI, it is a firewall's administrative interface and must not face the internet. If it is unidentified, treat it as an unknown listener until the certificate says otherwise.
$ openssl s_client -connect TARGET:981 </dev/null 2>/dev/null | openssl x509 -noout -subject -issuerSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.