Port 2488: moy-corp — A Registered Ghost

What This Port Is

Port 2488 sits in the registered port range (1024–49151) and carries an official IANA entry: service name moy-corp, assigned to Moy Corporation, on both TCP and UDP.

That's where the paper trail ends. There is no RFC describing the protocol, no public documentation of what moy-corp does, and no observable deployment of any service on this port. The registration exists; the protocol behind it does not appear to.

The Registered Range

Ports 1024–49151 are registered ports. Unlike well-known ports (0–1023), which require root privileges to bind on most Unix-like systems and carry protocols used by millions of machines daily, registered ports can be claimed by any organization that submits a request to IANA. ¹

The intent was order: companies register the ports their software needs, IANA records it, and collisions are avoided. In practice, the registry accumulated thousands of entries from companies that registered and then vanished, changed products, or simply never shipped the software the port was meant for.

Port 2488 is one of these. The slot is taken. The building is empty.

No Known Unofficial Uses

Unlike some dormant registered ports that get quietly adopted for other purposes (game servers, proprietary monitoring tools, peer-to-peer applications), port 2488 does not appear in any common software's default configuration. It has no notable presence in network security databases as a malware vector, no forum threads asking why it's open, no tool that opens it by default.

It is genuinely unremarkable. If you see it open on a machine, something put it there deliberately — and that's worth investigating.

How to Check What's Listening

If port 2488 is open on a system you manage:

Linux / macOS:

# Show what process is listening on port 2488
ss -tlnp | grep 2488

# Or with lsof
lsof -i :2488

Windows:

netstat -ano | findstr :2488

Then cross-reference the process ID (PID) with Task Manager or tasklist to identify the application.

Remotely:

# Test if port 2488 is open on a remote host
nc -zv hostname 2488

# Or with nmap
nmap -p 2488 hostname

Why Ghost Registrations Exist

IANA's port registry is not cleaned up automatically. Once a port is assigned, it stays assigned unless the organization actively requests removal — which rarely happens. The result is a registry that accurately reflects history but imperfectly reflects reality.

This matters because developers choosing ports for new applications should check the IANA registry, but should also recognize that a registered port with no active protocol may be as safe to use in a private network context as an unassigned one. ² On a public-facing system, any open port is a surface.

Port 2488 is a reminder that the registry is a record of intention, not a map of what's actually running.