{
  "port": 5952,
  "protocol": "tcp",
  "service": "Unassigned / VNC display :52",
  "oneLiner": "No registration; treat it as VNC display :52.",
  "whatItIs": "IANA lists nothing for 5952 — it sits in the Unassigned 5915-5962 block. The only convention that reaches it is RFB display numbering, where 5900+52 is display :52. There is no well-documented malware or scanner association specific to this number; it shows up in scan data at roughly the same low rate as its neighbours.",
  "exposure": {
    "verdict": "careful",
    "note": "Nothing standard owns this port, so identify the process before deciding anything — and if it is VNC, do not let it face the internet."
  },
  "checkCommand": "sudo lsof -nP -iTCP:5952 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services — the port-frequency database",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}