{
  "port": 5922,
  "protocol": "tcp",
  "service": "Unassigned / VNC display :22",
  "oneLiner": "Unassigned by IANA; in the wild it is VNC display :22.",
  "whatItIs": "5922 falls inside IANA's Unassigned 5915-5962 block, so nothing has a claim on it. The realistic listener is an RFB server on display :22, since VNC maps display :N onto 5900+N. The number is memorable enough that people also pick it by hand for a VNC session, the way 2222 gets picked for SSH.",
  "exposure": {
    "verdict": "never",
    "note": "Do not expose a VNC display directly. Tunnel it (ssh -L 5922:localhost:5922 TARGET) so authentication and confidentiality come from SSH rather than from RFB."
  },
  "checkCommand": "nc -w 3 TARGET 5922 | head -c 12; echo",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    }
  ]
}