{
  "port": 20000,
  "protocol": "both",
  "service": "DNP3 / Usermin",
  "oneLiner": "Two unrelated things share this port: DNP3, the electric-utility SCADA protocol, and Usermin's HTTPS admin interface.",
  "whatItIs": "IANA registers 20000 as 'dnp' for DNP3, the master/outstation protocol used between substation computers, RTUs and IEDs in electric utilities, water systems, and oil and gas; it is standardised as IEEE 1815 and DNP3-over-IP runs on TCP 20000. Independently, Usermin — the end-user companion to Webmin — defaults to HTTPS on 20000, so a scan hit is very often a Unix box offering webmail and password changes rather than a substation. The two are trivially told apart: Usermin answers a TLS handshake and serves HTML, DNP3 does not. On a general-purpose server assume Usermin; on an OT network assume DNP3.",
  "exposure": {
    "verdict": "never",
    "note": "DNP3 has no authentication or encryption in its base form and speaks directly to physical plant. Usermin is a user-facing admin plane. Neither belongs on a public IP — put both behind a VPN."
  },
  "checkCommand": "nmap -Pn -sV -p 20000 --reason TARGET",
  "links": [
    {
      "title": "DNP Users Group — Overview of DNP3",
      "url": "https://www.dnp.org/About/Overview-of-DNP3-Protocol",
      "kind": "official-docs"
    },
    {
      "title": "IEEE Std 1815 — Electric Power Systems Communications (DNP3)",
      "url": "https://standards.ieee.org/ieee/1815/5414/",
      "kind": "spec"
    },
    {
      "title": "Usermin — official documentation",
      "url": "https://webmin.com/usermin/",
      "kind": "official-docs"
    },
    {
      "title": "Usermin source repository",
      "url": "https://github.com/webmin/usermin",
      "kind": "github"
    }
  ]
}