X display :3 — and the one number in the X11 range IANA flags for known unauthorized use.
6003 is display :3 in IANA's 6000-6063 x11 assignment, and the registry attaches an explicit note to it: "Known Unauthorized Use on port 6003". That flag reflects backdoors and trojans that historically chose this port precisely because a listener there looks like an ordinary X display to a casual scan. A genuine X server here behaves exactly like 6000; the difference is that you should not assume it is one.
Do not expose
Confirm the listening process rather than trusting the port name — IANA itself records unauthorized use here. A real X display is still never safe to expose.
$ sudo lsof -nP -iTCP:6003 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.