{
  "port": 6646,
  "protocol": "tcp",
  "service": "Unassigned",
  "oneLiner": "Unassigned at IANA, but seen open more often than its neighbours in Nmap's scan data.",
  "whatItIs": "IANA lists the block 6641-6652 as Unassigned, so 6646 has no registered service. Nmap's service database gives it no name either, yet records it with an open-frequency an order of magnitude above the surrounding unnamed ports — meaning real software binds it in the field without any registration behind it. Endpoint-security agents are the usual suspects on Windows hosts, but no vendor documentation pins the port down, so identify the owning process rather than guessing from a name table.",
  "exposure": {
    "verdict": "careful",
    "note": "An unregistered port that is nevertheless commonly open is exactly the kind of listener worth naming before you leave it reachable."
  },
  "checkCommand": "sudo lsof -nP -iTCP:6646 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6646",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6646",
      "kind": "iana"
    },
    {
      "title": "nmap-services (Nmap's port/service frequency database)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}