{
  "port": 981,
  "protocol": "tcp",
  "service": "Unassigned — commonly Check Point embedded HTTPS management",
  "oneLiner": "IANA has nothing here; the recurring real-world sighting is a Check Point embedded appliance's HTTPS admin interface.",
  "whatItIs": "981 falls inside IANA's unassigned 954–988 block, so there is no registered service name, and nmap's service table lists it as unknown. The use that keeps turning up on scans is remote HTTPS management on Check Point's SofaWare-derived embedded firewalls — the Safe@Office and UTM-1 Edge line — which publish their web administration UI here instead of on 443. Beyond that, 981 is whatever a local admin decided to put on it. A TLS handshake usually settles the question, because the certificate names the device.",
  "exposure": {
    "verdict": "never",
    "note": "If it is the appliance management UI, it is a firewall's administrative interface and must not face the internet. If it is unidentified, treat it as an unknown listener until the certificate says otherwise."
  },
  "checkCommand": "openssl s_client -connect TARGET:981 </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry (954–988 unassigned)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services (981/tcp unknown)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}