{
  "port": 64623,
  "protocol": "tcp",
  "service": "Unassigned (dynamic range)",
  "oneLiner": "Unregistered, but common enough in Nmap's corpus to make every default scan.",
  "whatItIs": "64623 carries no IANA registration, per RFC 6335's rule that the Dynamic/Private range is never assigned. Nmap's nmap-services rates it \"unknown\" at 0.000760 — high for an unnamed port in this band, on par with 52869 and 55555 — which guarantees its place in the default top-1000 TCP list. Despite that frequency, SANS ISC still shows no service name and no tracked vulnerabilities. Something binds this port often enough to register statistically, and no public source says what.",
  "exposure": {
    "verdict": "careful",
    "note": "Frequently observed and never identified is not a reassuring combination. Find the process locally rather than assuming it is benign."
  },
  "checkCommand": "sudo lsof -nP -iTCP:64623 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 6335 — Dynamic Ports (49152-65535)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — search 64623",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=64623",
      "kind": "iana"
    },
    {
      "title": "nmap/nmap — nmap-services frequency data",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}