Port 2468: qip-msgd — A Ghost of the Instant Messaging Era

Port 2468 sits in the registered port range. IANA has a name on file for it: qip-msgd — the message delivery daemon for QIP (Quiet Internet Pager), a once-popular Russian instant messaging client. The software peaked around 2009. Most of its traffic has since moved elsewhere. The port entry remains.

The Registered Port Range

Port 2468 falls in the registered ports range: 1024 to 49151. These ports are:

• Not reserved for operating system use (unlike well-known ports 0–1023)
• Registered with IANA by applications that want a recognized, official port number
• Available for use by any application when not in active use by their registered owner

Registration doesn't mean enforcement. IANA records the assignment, but nothing prevents other software from binding to the same port on a given system. On any specific machine, whatever gets there first wins.

What qip-msgd Was

QIP was a multiprotocol instant messaging client developed by Ilgam Zyulkorneev, originally as an alternative ICQ client built on the OSCAR protocol. It became dominant in Russia and ex-USSR countries — at its peak, QIP carried roughly 80% of Russia's ICQ traffic and had around 10 million unique users.¹

In 2008, the Russian media company RosBusinessConsulting acquired QIP. The following year it was named RBC's most popular service.¹

Then the messaging landscape shifted. WhatsApp, Telegram, and VKontakte's messaging features absorbed the users. QIP faded. Port 2468, registered for qip-msgd, became a name without active software behind it.

Security Notes

Port 2468 has appeared in older security databases as associated with suspicious activity — some sources flag it as having been used by malware at some point.² This is common for registered ports attached to obscure or defunct software: without active legitimate traffic, any activity on the port stands out.

If you see unexpected traffic on port 2468, treat it as you would any unrecognized open port: investigate before assuming it's benign.

How to Check What's Listening on This Port

macOS / Linux:

lsof -i :2468

Linux (alternative):

ss -tlnp | grep 2468

Windows:

netstat -ano | findstr :2468

These commands show which process, if any, has bound to port 2468. On most systems today, you'll find nothing — which is the expected answer.

Why Unassigned-but-Registered Ports Matter

The port system only works because of rough consensus about what lives where. Registered ports give software a stable address — developers and firewall administrators can document, allow, or block specific traffic by port number.

When software dies but its port registration lives on, that number becomes a minor landmark: a name in IANA's records pointing at something that no longer needs it. The port is technically available. It's just wearing a nametag that belongs to someone who left the party.

Port 2468 is one of thousands of these: registered, quiet, and waiting for either a revival or a cleanup that never quite happens.