Internet-Security.com TCP port 1027 details

TCP 1027 is commonly seen as a dynamically assigned Microsoft RPC (MSRPC/DCOM) endpoint on older Windows systems (Windows 2000/XP/Server 2003), which used the 1025–5000 dynamic port range by default.
In real deployments, Windows services that use RPC—such as the legacy Windows Messenger service (net send pop-up service), the Event Log service, and Active Directory RPC endpoints on domain controllers—have been observed listening on 1027/tcp.
Network scans of such hosts frequently identify 1027/tcp as “msrpc” (e.g., via Nmap) due to this dynamic allocation.
Abuse: In the early 2000s, spammers and some malware targeted the Messenger service over RPC, commonly probing TCP/UDP 1026–1027 to push pop-up spam, which led many administrators to block 1027 at perimeter firewalls.

TCP 1027