{
  "port": 119,
  "protocol": "tcp",
  "service": "NNTP",
  "oneLiner": "Usenet news transport and reading — NNTP in the clear, with NNTPS on 563.",
  "whatItIs": "NNTP, current spec RFC 3977, moves Usenet articles between news servers and serves readers with commands like GROUP, ARTICLE and POST over a line-oriented text session. INN and Diablo are the common server implementations, and commercial Usenet providers still run large farms of them. Port 119 is the cleartext port; TLS-wrapped NNTPS lives on 563 and is what providers push clients toward. Seeing 119 open usually means a real news server or a peering endpoint, not an accident.",
  "exposure": {
    "verdict": "careful",
    "note": "Public read-only news service on 119 is fine by design, but any authenticated feed or posting account should be on 563 so credentials are not sent in the clear."
  },
  "checkCommand": "printf 'QUIT\\r\\n' | nc -v TARGET 119",
  "links": [
    {
      "title": "RFC 3977 — Network News Transfer Protocol (NNTP)",
      "url": "https://www.rfc-editor.org/rfc/rfc3977.html",
      "kind": "spec"
    },
    {
      "title": "InterNetNews (INN) source repository",
      "url": "https://github.com/InterNetNews/inn",
      "kind": "github"
    },
    {
      "title": "INN documentation",
      "url": "https://www.eyrie.org/~eagle/software/inn/",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}