{
  "port": 2022,
  "protocol": "tcp",
  "service": "down (IANA) / alternate SSH in practice",
  "oneLiner": "Registered as down, but in the field it is usually SSH moved off 22.",
  "whatItIs": "IANA registers 2022/tcp as down and 2022/udp as xinuexpansion2, neither of which corresponds to real software. The common reason this port is open is a second sshd, or a container or appliance publishing SSH on an alternate port to keep 22 free on the host. Connect and read the banner: a real SSH server announces itself with a line like SSH-2.0-OpenSSH_9.6 before anything else.",
  "exposure": {
    "verdict": "careful",
    "note": "Moving SSH off 22 only quiets the logs, it is not a control — if it is SSH, judge it as SSH (public-key only, passwords disabled); if it is something else, identify it first."
  },
  "checkCommand": "nc -w 3 TARGET 2022 | head -1",
  "links": [
    {
      "title": "IANA port registry — 2022 (down)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2022",
      "kind": "iana"
    }
  ]
}