{
  "port": 1001,
  "protocol": "tcp",
  "service": "webpush (HTTP Web Push registration)",
  "oneLiner": "RFC 8030 registered this port for HTTP Web Push, then said the service runs on 443 — so nothing listens here.",
  "whatItIs": "RFC 8030, Generic Event Delivery Using HTTP Push, registered the service name webpush on port 1001 in section 9.3, while the same document notes that the push service shares the default 443/TCP with HTTPS. Real push endpoints — the browser vendors' servers behind the Web Push API — are ordinary HTTPS on 443, so the 1001 registration exists on paper only. IANA marks 1001/udp Reserved. An open 1001 is therefore a local application that took a free port, not push.",
  "exposure": {
    "verdict": "careful",
    "note": "Nothing standard is here to reason about, so whatever answers needs identifying on its own merits before it is reachable from outside the host."
  },
  "checkCommand": "nc -vz -w 3 TARGET 1001",
  "links": [
    {
      "title": "RFC 8030 — Generic Event Delivery Using HTTP Push (§9.3 registers webpush/1001)",
      "url": "https://www.rfc-editor.org/rfc/rfc8030.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1001",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1001",
      "kind": "iana"
    }
  ],
  "ianaName": "webpush"
}