{
  "port": 65000,
  "protocol": "tcp",
  "service": "Unassigned — round number with a DDoS-tool history",
  "oneLiner": "A round number near the top of the port space, remembered mainly for 1999-era DDoS handlers.",
  "whatItIs": "65000 is unregistered and unregisterable: RFC 6335 reserves 49152-65535 for dynamic and private use. Its 0.000760 frequency in Nmap's nmap-services reflects how often people pick round numbers for ad hoc listeners. The SANS ISC port page attaches a set of legacy backdoor and DDoS names to it — Devil, Sockets des Troie, and the Stacheldraht agent and handler, the last being a real 1999 distributed denial-of-service toolkit — all of which are historical rather than current threats. Today a listener here is far more likely to be someone's own service on a memorable port than any of those.",
  "exposure": {
    "verdict": "careful",
    "note": "Round, memorable ports get scanned constantly and forgotten easily. Identify the process; if you cannot, close it rather than leaving it reachable."
  },
  "checkCommand": "sudo lsof -nP -iTCP:65000 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 6335 — Dynamic Ports (49152-65535)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — search 65000 (no assignment)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=65000",
      "kind": "iana"
    },
    {
      "title": "SANS Internet Storm Center — port 65000 activity and historical names",
      "url": "https://isc.sans.edu/port.html?port=65000",
      "kind": "official-docs"
    }
  ]
}