{
  "port": 222,
  "protocol": "tcp",
  "service": "rsh-spx (in practice: relocated SSH)",
  "oneLiner": "Registered to Berkeley rshd with SPX authentication; in practice a common alternate SSH port.",
  "whatItIs": "IANA registers 222 as `rsh-spx`, Berkeley `rshd` using SPX authentication — a Kerberos-era variant of the rsh remote-shell family that is long dead. What you actually meet on 222 is a relocated SSH daemon: shared hosts and home routers move sshd off 22 to cut log noise from password-guessing bots, and 222 is one of the favored destinations. A banner grab settles it immediately, since SSH announces itself with an `SSH-2.0-...` line. Moving the port reduces noise, not risk.",
  "exposure": {
    "verdict": "careful",
    "note": "If it is SSH, the exposure rules for port 22 apply and the port number changes nothing. If it is genuinely rsh, it is cleartext remote shell and must not be reachable."
  },
  "checkCommand": "nc -v TARGET 222",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}