{
  "port": 4321,
  "protocol": "tcp",
  "service": "RWhois (Referral Whois)",
  "oneLiner": "Referral Whois — a whois variant that hands you a pointer to the server holding the real answer.",
  "whatItIs": "RWhois, specified in RFC 2167, extends the whois model with hierarchy: a query that a server cannot answer comes back as a referral to the server that can, which is how regional registries delegate detail for delegated IP blocks. Servers greet with a version banner such as %rwhois V-1.5 before any query. Most surviving deployments are ISPs and hosting providers publishing SWIP-style reassignment data for their address space.",
  "exposure": {
    "verdict": "fine",
    "note": "It is a public directory service by design and carries no credentials; the only real concern is the contact detail you choose to publish in it."
  },
  "checkCommand": "nc -w 3 TARGET 4321 < /dev/null | head -1",
  "links": [
    {
      "title": "RFC 2167 — Referral Whois (RWhois) Protocol V1.5",
      "url": "https://www.rfc-editor.org/rfc/rfc2167.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 4321 (rwhois)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4321",
      "kind": "iana"
    }
  ]
}