{
  "port": 1022,
  "protocol": "tcp",
  "service": "exp2 — RFC 3692-style experiment",
  "oneLiner": "The second RFC 4727 experiment port, and the one people actually squat on — often with SSH.",
  "whatItIs": "1022 is exp2, the partner to 1021 in RFC 4727's pair of ports reserved for RFC 3692-style experimentation across TCP, UDP, SCTP and DCCP. Its registration is identical to 1021's, but nmap's data shows 1022 open several times more often, which reflects services parked on it rather than experiments being run. Moving SSH to a nonstandard low port is a common reason; shared hosting providers in particular have used 1022 and 2222 this way. Confirm by banner: a real SSH server announces itself in cleartext on connect.",
  "exposure": {
    "verdict": "careful",
    "note": "If it is SSH it is still SSH — the odd port buys quieter logs, not security, so key-only authentication still does the actual work. If it is something else, it is a production service on a port reserved for experiments."
  },
  "checkCommand": "nc -v -w 3 TARGET 1022",
  "links": [
    {
      "title": "RFC 4727 — Experimental Values in IPv4, IPv6, ICMP, UDP, TCP headers",
      "url": "https://www.rfc-editor.org/rfc/rfc4727.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1022",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1022",
      "kind": "iana"
    },
    {
      "title": "nmap-services (1022/tcp exp2)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "exp2"
}