{
  "port": 2222,
  "protocol": "both",
  "service": "EtherNet/IP I/O, SSH alternate, DirectAdmin",
  "oneLiner": "Three unrelated things share this number: EtherNet/IP I/O, a moved SSH daemon, and the DirectAdmin control panel.",
  "whatItIs": "IANA registers 2222 to ODVA as EtherNet/IP-1 for EtherNet/IP I/O — the cyclic UDP \"implicit messaging\" that carries real-time data between PLCs and devices, with explicit (request/response) messaging on 44818. On IT networks the same number means something else entirely: it is the most common place admins move sshd to, and it is the default port of the DirectAdmin hosting control panel, whose documentation discusses changing it because 2222 cannot be proxied through Cloudflare. Identify the service before drawing any conclusion — an SSH banner, a TLS web login, and industrial I/O look nothing alike.",
  "exposure": {
    "verdict": "careful",
    "note": "Depends entirely on what answers. OpenSSH here is exactly as safe as on 22 (moving it cuts log noise, it is not a control). EtherNet/IP has no authentication and must never leave the plant network, and a hosting control panel is an admin plane worth restricting by source address."
  },
  "checkCommand": "nc -v TARGET 2222",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 2222 (EtherNet/IP-1)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2222",
      "kind": "iana"
    },
    {
      "title": "DirectAdmin Docs — directadmin.conf values (default port 2222)",
      "url": "https://docs.directadmin.com/directadmin/general-usage/all-directadmin-conf-values.html",
      "kind": "official-docs"
    }
  ],
  "ianaName": "EtherNet/IP-1"
}