{
  "port": 3000,
  "protocol": "tcp",
  "service": "Node/Express dev server, Grafana",
  "oneLiner": "The default port for Node web frameworks in development, and the default port Grafana serves on in production.",
  "whatItIs": "Port 3000 is the convention baked into Express's own hello-world example and inherited by most Node-based frameworks and their dev servers. Grafana also binds 3000 by default (http_port), which is the usual reason a 3000 shows up on a server that nobody is developing on. IANA has 3000 registered as hbci and remoteware-cl, neither of which you will meet in practice. On a scan it means either a developer machine or a forgotten dashboard.",
  "exposure": {
    "verdict": "careful",
    "note": "Fine behind a reverse proxy for a real app like Grafana, but a framework dev server on 3000 should never face the internet."
  },
  "checkCommand": "sudo lsof -nP -iTCP:3000 -sTCP:LISTEN",
  "links": [
    {
      "title": "Express — Hello world example (listens on 3000)",
      "url": "https://expressjs.com/en/starter/hello-world.html",
      "kind": "official-docs"
    },
    {
      "title": "Grafana — Configure Grafana (http_port defaults to 3000)",
      "url": "https://grafana.com/docs/grafana/latest/setup-grafana/configure-grafana/",
      "kind": "official-docs"
    },
    {
      "title": "grafana/grafana on GitHub",
      "url": "https://github.com/grafana/grafana",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 3000",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3000",
      "kind": "iana"
    }
  ],
  "ianaName": "hbci / remoteware-cl"
}