{
  "port": 2323,
  "protocol": "tcp",
  "service": "Telnet alternate (IoT)",
  "oneLiner": "Registered as 3d-nfsd, used in the real world as a second telnet port on embedded devices — and scanned constantly because of it.",
  "whatItIs": "IANA registers 2323 as 3d-nfsd, a name you will effectively never see on the wire. What actually listens here is telnet: consumer routers, IP cameras, DVRs, and other embedded gear that either moved telnet off 23 or ran a second instance on 2323. Mirai and its many derivatives scan both 23 and 2323 and try lists of default credentials against whatever answers, which is why 2323 sees continuous unsolicited traffic on any public IP. The leaked Mirai source shows the scanner and its credential list directly.",
  "exposure": {
    "verdict": "never",
    "note": "Cleartext login with no server authentication, on the exact port a decade of IoT botnets brute-force by default. There is no safe internet-facing configuration — disable it and use SSH."
  },
  "checkCommand": "nc -v TARGET 2323",
  "links": [
    {
      "title": "Mirai source code (bot, scanner, loader, CnC) — research archive",
      "url": "https://github.com/jgamblin/Mirai-Source-Code",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 2323 (3d-nfsd)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2323",
      "kind": "iana"
    }
  ],
  "ianaName": "3d-nfsd"
}