{
  "port": 50389,
  "protocol": "tcp",
  "service": "Unassigned (dynamic range) — offset LDAP in practice",
  "oneLiner": "Unregistered, but the number is LDAP's 389 plus a 50000 offset, which is how unprivileged directory servers are usually run.",
  "whatItIs": "There is no IANA assignment for 50389; RFC 6335 puts it in the Dynamic/Private range. What the number does encode is a common convention: a directory server running as a non-root user cannot bind 389, so deployments shift the standard LDAP pair by a fixed offset — the same trick ApacheDS ships by default with 10389 and 10636. An open 50389 alongside 50636 is a strong hint of an offset LDAP/LDAPS pair, but it is a hint, not an assignment, and an LDAP search is the way to confirm it.",
  "exposure": {
    "verdict": "never",
    "note": "If it is LDAP, it is a cleartext directory service carrying simple-bind credentials and your whole identity tree; keep it internal and use the TLS port."
  },
  "checkCommand": "ldapsearch -x -H ldap://TARGET:50389 -s base -b '' namingContexts",
  "links": [
    {
      "title": "RFC 4511 — Lightweight Directory Access Protocol (LDAP): The Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc4511.html",
      "kind": "spec"
    },
    {
      "title": "RFC 6335 — IANA Procedures for Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}