{
  "port": 12345,
  "protocol": "tcp",
  "service": "NetBus (in practice) / italk (IANA)",
  "oneLiner": "The most-typed port number there is: registered to italk, famous as the NetBus backdoor, and used daily as a throwaway test port.",
  "whatItIs": "IANA registers 12345 to `italk`, the Italk Chat System, which nobody runs. The number's reputation comes from NetBus, a Windows remote-control backdoor from 1998 that listened on 12345 with a second channel on 12346, and which is well enough documented that Nmap ships a `netbus-info` NSE script and Nmap's service table names the port `netbus`. Trend Micro's OfficeScan agent also used 12345, which produced a long history of false-positive backdoor alerts on corporate desktops. In modern practice most sightings are neither: 12345 is the reflexive choice for a scratch listener, a debug server, or a container port mapping.",
  "exposure": {
    "verdict": "never",
    "note": "Either it is a remote-control backdoor, or it is a hastily configured test service that nobody hardened. Neither belongs on a public IP."
  },
  "checkCommand": "nmap -Pn -p 12345 --script netbus-info TARGET",
  "links": [
    {
      "title": "Nmap NSE — netbus-info",
      "url": "https://nmap.org/nsedoc/scripts/netbus-info.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 12345 (italk)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=12345",
      "kind": "iana"
    }
  ]
}