{
  "port": 6003,
  "protocol": "tcp",
  "service": "X11 (display :3)",
  "oneLiner": "X display :3 — and the one number in the X11 range IANA flags for known unauthorized use.",
  "whatItIs": "6003 is display :3 in IANA's 6000-6063 x11 assignment, and the registry attaches an explicit note to it: \"Known Unauthorized Use on port 6003\". That flag reflects backdoors and trojans that historically chose this port precisely because a listener there looks like an ordinary X display to a casual scan. A genuine X server here behaves exactly like 6000; the difference is that you should not assume it is one.",
  "exposure": {
    "verdict": "never",
    "note": "Confirm the listening process rather than trusting the port name — IANA itself records unauthorized use here. A real X display is still never safe to expose."
  },
  "checkCommand": "sudo lsof -nP -iTCP:6003 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA port registry — 6000-6063 (x11), incl. the unauthorized-use note",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=x11",
      "kind": "iana"
    },
    {
      "title": "X.Org — Xserver(1) manual page",
      "url": "https://xorg.freedesktop.org/archive/current/doc/man/man1/Xserver.1.xhtml",
      "kind": "official-docs"
    }
  ]
}