{
  "port": 2009,
  "protocol": "tcp",
  "service": "news",
  "oneLiner": "Registered as news — unrelated to NNTP, which lives on 119.",
  "whatItIs": "IANA registers 2009/tcp as news and 2009/udp as whosockami, with no descriptions. The name is misleading: Usenet news is NNTP on 119, not here, and nothing maintained claims 2009. An open port here is most likely Cisco reverse telnet to line 9 or an arbitrary local service.",
  "exposure": {
    "verdict": "careful",
    "note": "Do not trust the registered name — identify the real listener before exposing it."
  },
  "checkCommand": "nc -vz TARGET 2009",
  "links": [
    {
      "title": "IANA port registry — 2009 (news)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2009",
      "kind": "iana"
    }
  ]
}