{
  "port": 2121,
  "protocol": "tcp",
  "service": "Alternate FTP / FTP proxy",
  "oneLiner": "FTP's unprivileged twin — where an FTP server or FTP proxy lands when it cannot bind port 21.",
  "whatItIs": "IANA registers 2121 as SCIENTIA-SSDB, but that is not what runs there. In practice 2121 is the conventional alternate FTP port: it is above 1024, so a daemon can bind it without root, and it is where FTP proxies land — Nmap names the port ccproxy-ftp after CCProxy's FTP proxy service. It is common enough to matter, open on roughly 0.6% of scanned hosts, well ahead of everything around it. A connection returns a normal FTP banner, and the protocol is RFC 959 FTP with all of its properties intact.",
  "exposure": {
    "verdict": "careful",
    "note": "Same rules as port 21: cleartext credentials unless the session negotiates AUTH TLS (RFC 4217), and an open FTP proxy here can be abused to relay traffic. Moving FTP off 21 hides it from nobody."
  },
  "checkCommand": "printf 'QUIT\\r\\n' | nc -v TARGET 2121",
  "links": [
    {
      "title": "RFC 959 — File Transfer Protocol (FTP)",
      "url": "https://www.rfc-editor.org/rfc/rfc959.html",
      "kind": "spec"
    },
    {
      "title": "nmap-services — 2121/tcp listed as ccproxy-ftp",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}