{
  "port": 999,
  "protocol": "tcp",
  "service": "garcon / puprouter (legacy registrations)",
  "oneLiner": "Three ancient registrations share this number and none of them is what you actually found.",
  "whatItIs": "IANA lists both garcon and puprouter on 999/tcp, plus Applix ac on 999/udp — legacy assignments with no descriptions and no public specifications. Nothing in current use implements any of them. What people actually do with 999 is pick it because it is memorable: alternate HTTP admin interfaces on consumer routers and IP cameras, proxies, and application ports on hosts that wanted something out of the way. Identify it by response, not by name; an HTTP request is the fastest first probe.",
  "exposure": {
    "verdict": "careful",
    "note": "No standard service means no standard security story. If it turns out to be a device's web admin UI — the most common case — that is a management plane and should not be internet-facing."
  },
  "checkCommand": "curl -sv -o /dev/null --max-time 5 http://TARGET:999/",
  "links": [
    {
      "title": "IANA port registry — 999",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=999",
      "kind": "iana"
    },
    {
      "title": "nmap-services (999/tcp garcon | puprouter | applix)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "garcon / puprouter"
}