TCP Port 31337 – "eleet" (unofficial / malware-associated)
Port 31337 has no canonical legitimate service. Its cultural and security significance is rooted entirely in the leetspeak convention of substituting digits for letters: read with 3 as E, 1 as L, and 7 as T, the digits 31337 spell “eleet”, an emphatic variant of “elite” that became a marker in hacker culture from the 1990s onward. Port 31337 is therefore a more elaborate sibling of port 1337, which uses the four-digit “leet” form. Both ports were chosen by software authors, hobbyists, and malware writers as deliberate cultural signals.
The IANA registry shows a single recent assignment for this port: “eldim”, a secure file upload proxy registered by Antonios Chariton in 2021. The choice of port 31337 for a security-related project appears to be a deliberate cultural reference rather than coincidence; the eldim project itself is small in deployment and is rarely encountered.
The port’s recurring contexts overlap with port 1337’s. Various small open-source projects and demonstrations have used 31337 for hobbyist services. Malware families, particularly Windows backdoors from the late 1990s and early 2000s, have used it as a default command-and-control or listener port. Penetration testing exercises and capture-the-flag competitions sometimes use port 31337 as a deliberate joke port for staged services. Network administrators occasionally see the port in firewall logs and recognize it as worth a closer look precisely because of these associations.
Outbound TCP/31337 from end-user devices is uncommon and is generally worth investigating. Inbound TCP/31337 to a host that does not have a specific reason to listen on this port is unusual and is widely treated as either a hobbyist service or a sign of unauthorized software running on the host.
UDP/31337 carries the same eldim registration but is rarely encountered in practice.
About TCP Port 31337
Port 31337 carries the IANA assignment for eldim. The IANA description reads: ‘eldim is a secure file upload proxy’.
Security Considerations
The defining piece of malware history for port 31337 is Back Orifice 2000. Released by the Cult of the Dead Cow (cDc) hacker group at DEF CON 7 in July 1999, Back Orifice 2000 (BO2k) was the successor to the original Back Orifice (1998) and was distributed as an open-source remote administration tool with deliberately provocative framing. The cDc’s stated purpose was to draw public attention to the absence of meaningful security in Microsoft Windows of that era; the actual effect was that BO2k became one of the most-used Windows backdoors of the late 1990s and early 2000s. Its default listener port was TCP/31337, chosen for its cultural associations rather than any technical reason.
Our data includes a Snort rule (sid=3155) that detects inbound Back Orifice 2000 traffic. The rule remains in modern rule sets despite BO2k’s age because legacy installations and re-purposed copies of the malware continue to surface, and because the specific traffic pattern is a useful marker for forensic analysis of older incidents.
A second IDS rule in our data covers a more recent threat: Linux.DDoS.D93, a Linux DDoS bot whose outbound command-and-control connections were observed using port 31337. This rule reflects a continuing pattern: malware families spanning many decades and platforms have used port 31337 for command channels and listeners, with the cultural-reference choice surviving as malware ecosystems have otherwise evolved beyond the late-1990s Windows era.
The threat picture is therefore similar to port 1337’s: no canonical service to defend, but a meaningful cultural association that makes any unexpected appearance of port 31337 in network logs worth investigating. Inbound TCP/31337 to a host that has no specific reason to listen is a strong signal of unauthorized software, and outbound TCP/31337 from end-user workstations to internet destinations is a high-priority alerting condition.
Defensive practice is straightforward. No production service should listen on port 31337 in a managed environment. Detection rules for both Back Orifice 2000 and modern bot families using the port remain useful. Network monitoring should treat any sustained traffic on this port as worth examining, regardless of the apparent direction or destination.
IDS Rule References
2 IDS / security rules reference TCP port 31337. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 1): trojan-activity (2).
Sample rule descriptions for TCP port 31337:
- MALWARE-BACKDOOR BackOrifice 2000 Inbound Traffic
- MALWARE-CNC Linux.DDoS.D93 outbound connection
Malware Activity
Some malware indicators are observed on this port.
2 of 2 IDS rules for TCP port 31337 involve malware activity.
Families observed (top 2): BackOrifice (1), DDoS.D93 (1).
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry and Snort Community Rules (GPLv2).