{
  "port": 10001,
  "protocol": "both",
  "service": "scp-config / Ubiquiti discovery",
  "oneLiner": "Registered as scp-config; on UDP it is Ubiquiti's device-discovery responder, a known amplification reflector.",
  "whatItIs": "IANA registers 10001 on both transports as scp-config (\"SCP Configuration\"), which you will rarely encounter. The listener that matters is on UDP: Ubiquiti's discovery protocol, which UniFi and airMAX devices answer with their model, firmware, MAC, and hostname. It is a documented DDoS reflector at roughly 7x amplification, with about 127,000 exposed reflectors counted in 2020. On TCP, 10001 shows up mostly as a raw serial-over-Ethernet port on device servers and as a generic alternate application port; Nmap sees TCP 10001 open on about 0.13% of hosts.",
  "exposure": {
    "verdict": "never",
    "note": "The UDP responder both enumerates your hardware and hands attackers an amplifier — firewall it at the edge. Raw serial redirectors on TCP 10001 typically have no authentication at all."
  },
  "checkCommand": "sudo nmap -sU -sV -p 10001 TARGET",
  "links": [
    {
      "title": "IANA port registry — 10001 (scp-config)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=10001",
      "kind": "iana"
    },
    {
      "title": "AMP-Research — UDP 10001 Ubiquiti discovery amplification",
      "url": "https://github.com/Phenomite/AMP-Research/blob/master/Port%2010001%20-%20Ubiquiti/README.md",
      "kind": "github"
    }
  ]
}