{
  "port": 60443,
  "protocol": "tcp",
  "service": "Unassigned — commonly an alternate HTTPS port",
  "oneLiner": "An alternate HTTPS port by shape, not by standard — 443 with a prefix.",
  "whatItIs": "Nothing is registered at 60443; RFC 6335 puts it in the Dynamic/Private range that IANA leaves alone. Like 8443 and 58080, the digits are the tell: it is chosen by hand for a TLS listener when the obvious ports are occupied, often an appliance or application management interface. Nmap's nmap-services lists it \"unknown\" at 0.000228, and SANS ISC has no service name for it. A TLS handshake and its certificate will identify the owner faster than any port database.",
  "exposure": {
    "verdict": "careful",
    "note": "TLS on a nonstandard port is still TLS, but an administrative console is an administrative console. Restrict by source address or put it behind a VPN rather than relying on the unusual port number."
  },
  "checkCommand": "openssl s_client -connect TARGET:60443 -brief </dev/null",
  "links": [
    {
      "title": "RFC 6335 — Dynamic Ports (49152-65535)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — search 60443 (no assignment)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=60443",
      "kind": "iana"
    },
    {
      "title": "Nmap Reference Guide — the nmap-services file",
      "url": "https://nmap.org/book/nmap-services.html",
      "kind": "official-docs"
    }
  ]
}