{
  "port": 6667,
  "protocol": "tcp",
  "service": "IRC",
  "oneLiner": "The default plaintext IRC port — where clients connect to chat networks without TLS.",
  "whatItIs": "An IRC client opens 6667, sends NICK and USER, and the server answers with a numeric welcome burst and the MOTD; from there everything is line-based text terminated by CRLF, as defined in RFC 1459 and its successors. It is the default port in essentially every IRC client, inside IANA's 6665-6669 ircu block, and RFC 7194 names 6697 as its TLS counterpart. It still shows up on scans of chat networks, of bouncers, and of IRC-controlled malware that never moved off the classic port.",
  "exposure": {
    "verdict": "careful",
    "note": "Everything is cleartext, including the password you send to NickServ. Fine for a public chat server that offers TLS on 6697 alongside; never the right choice for anything private."
  },
  "checkCommand": "printf 'QUIT\\r\\n' | nc -v -w 5 TARGET 6667",
  "links": [
    {
      "title": "RFC 1459 — Internet Relay Chat Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc1459.html",
      "kind": "spec"
    },
    {
      "title": "RFC 7194 — Default Port for Internet Relay Chat (IRC) via TLS/SSL",
      "url": "https://www.rfc-editor.org/rfc/rfc7194.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6665-6669 (ircu)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6667",
      "kind": "iana"
    },
    {
      "title": "ircu2 — Undernet IRC Daemon",
      "url": "https://github.com/UndernetIRC/ircu2",
      "kind": "github"
    }
  ]
}