{
  "port": 5222,
  "protocol": "tcp",
  "service": "XMPP client connection",
  "oneLiner": "An XMPP (Jabber) server accepting client logins — chat, presence, and push behind many apps.",
  "whatItIs": "RFC 6120 assigns 5222 to XMPP client-to-server streams: the client opens a TCP connection, exchanges XML stream headers, upgrades to TLS with STARTTLS, then authenticates over SASL. Prosody, ejabberd, and Openfire all listen here by default, and it is still the transport under group chat, IoT messaging, and several game and push backends. A scan hit means a real XMPP server, since the port has no common squatters.",
  "exposure": {
    "verdict": "fine",
    "note": "Public by design — but require STARTTLS (or use the direct-TLS port 5223) so credentials never cross the wire before encryption."
  },
  "checkCommand": "printf \"<stream:stream to='TARGET' xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' version='1.0'>\" | nc -w 3 TARGET 5222",
  "links": [
    {
      "title": "RFC 6120 — XMPP: Core",
      "url": "https://www.rfc-editor.org/rfc/rfc6120.html",
      "kind": "spec"
    },
    {
      "title": "Prosody — ports and network configuration",
      "url": "https://prosody.im/doc/ports",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5222 (xmpp-client)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5222",
      "kind": "iana"
    }
  ]
}