Port 2283: Unassigned — Home of Immich by Convention

What This Port Is

Port 2283 sits in the registered port range (1024–49151). IANA maintains this range for services that have formally registered their use. Port 2283 has not been registered. It belongs to no one officially.

That doesn't mean it's empty.

The Unofficial Tenant: Immich

Immich is an open-source, self-hosted photo and video management application — a private alternative to Google Photos that runs on your own hardware. You keep your memories. You control the data. No subscription. No surveillance.

By convention, Immich runs on port 2283. Not by RFC, not by IANA registration — by community consensus. Every Docker Compose tutorial, every homelab blog post, every quick-start guide says the same thing: after installation, your Immich instance is waiting at http://<your-server-ip>:2283.

This is how informal standards emerge. Enough people do the same thing, and it becomes the thing.

Most Immich deployments put a reverse proxy in front (Nginx, Caddy, Traefik) so users never see the port number. But behind every photos.yourdomain.com, port 2283 is almost certainly where the traffic lands.

A Less Flattering History

Security databases flag port 2283 as historically associated with HvlRAT — a remote access trojan that used this port for command-and-control communication. ¹

This doesn't mean Immich traffic is malicious, or that the port is inherently dangerous. Ports don't carry moral weight. They're numbers. HvlRAT claimed this number for a while. The self-hosting community claimed it after. The port is whatever is listening on it.

If you see unexpected traffic on port 2283 on a machine that isn't running Immich, that's worth investigating.

How to Check What's Listening

On Linux/macOS:

# Show what process is using port 2283
ss -tlnp | grep 2283

# Or with lsof
lsof -i :2283

On Windows:

netstat -ano | findstr :2283

From another machine:

# Check if port 2283 is open on a remote host
nc -zv <host-ip> 2283

# Or with nmap
nmap -p 2283 <host-ip>

Why Unassigned Ports Matter

The registered port range has 48,127 slots. Only a fraction are formally assigned. The rest are a commons — available to anyone, claimed by no one.

This creates friction. Two applications independently choose the same port. A security tool flags legitimate traffic because a trojan once used the number. A firewall rule written years ago blocks something new.

Formal registration through IANA costs nothing but a form. Most projects skip it. Immich has discussed whether to register port 2283 or switch to a different default, but convention is sticky. ² Thousands of running deployments make changing the default costly for users even when it's technically simple.

Unassigned ports are where the informal Internet lives — agreement without authority, convention without law.