Port 2912: Epicon — A registered ghost

Port 2912 sits in the registered port range, officially claimed — but if you're looking for something actually running here, you'll probably find nothing.

What Range This Port Belongs To

Port 2912 falls in the registered ports range (1024–49151), sometimes called the user ports. This range is where IANA records assignments for specific services and applications, but unlike the well-known ports below 1024, no elevated privileges are required to bind here. Any process on your system can open port 2912.

The registered range is enormous — over 48,000 ports — and IANA manages it on a first-come, first-served basis. Organizations and developers apply, IANA records the assignment, and that's largely the end of enforcement. There's no requirement that the service ever ship, that the company still exist, or that anyone ever actually use the port.

The Epicon Registration

IANA lists port 2912 (both TCP and UDP) as assigned to Epicon, with contact attributed to Michael Khalandovsky at epicon.com.¹ That's the entirety of the public record.

What is Epicon? Unknown. No RFC defines the protocol. No publicly available software claims to use it. No documentation describes what it does. The registration exists, the contact email exists, and nothing else does — at least nothing findable.

This is more common than it sounds. The IANA registry holds thousands of entries for services that registered a port, then went quiet. Startups that folded. Internal tools that never productized. Projects abandoned before launch. The port stays registered indefinitely; the product doesn't have to.

Port 2912 appears to be one of these. It's not dangerous — it's just empty.

What You're Likely to Find on This Port

Almost certainly: nothing. Port 2912 has no active presence in security databases, no documented malware associations, and no widely deployed service. If something is listening on this port on your machine, it's an application you installed, not Epicon.

How to Check What's Listening

If you see traffic on port 2912 and want to know what's responsible:

On Linux or macOS:

# Show what process is listening on port 2912
ss -tlnp | grep 2912
# or
lsof -i :2912

On Windows:

netstat -ano | findstr :2912

The output will give you a process ID (PID), which you can look up in Task Manager or with ps aux to identify the application.

Why Ghost Registrations Exist

The IANA port registry wasn't designed to be a living, curated catalog. It was designed to prevent collisions — to ensure two services don't accidentally choose the same port and conflict. Once a port is registered, the registry doesn't expire it when the service disappears.

This means the registered range contains a mix of actively used ports (PostgreSQL on 5432, Redis on 6379), niche but real services, and a long tail of ghost entries like port 2912 — reserved in perpetuity for something that may no longer exist.

It's the Internet's version of a reserved parking space with nobody's name on it anymore.