Three unrelated things share this number: EtherNet/IP I/O, a moved SSH daemon, and the DirectAdmin control panel.
IANA registers 2222 to ODVA as EtherNet/IP-1 for EtherNet/IP I/O — the cyclic UDP "implicit messaging" that carries real-time data between PLCs and devices, with explicit (request/response) messaging on 44818. On IT networks the same number means something else entirely: it is the most common place admins move sshd to, and it is the default port of the DirectAdmin hosting control panel, whose documentation discusses changing it because 2222 cannot be proxied through Cloudflare. Identify the service before drawing any conclusion — an SSH banner, a TLS web login, and industrial I/O look nothing alike.
Expose with care
Depends entirely on what answers. OpenSSH here is exactly as safe as on 22 (moving it cuts log noise, it is not a control). EtherNet/IP has no authentication and must never leave the plant network, and a hosting control panel is an admin plane worth restricting by source address.
$ nc -v TARGET 2222Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.