{
  "port": 9998,
  "protocol": "both",
  "service": "distinct32",
  "oneLiner": "Registered to Distinct Corporation's Distinct32 toolkit; almost always something else in practice.",
  "whatItIs": "IANA registers 9998 on both TCP and UDP as distinct32, assigned to Distinct Corporation alongside 9999 (distinct) — a pairing from their Windows TCP/IP developer toolkit. You will essentially never meet the registered service. What turns up on 9998 today is an alternate HTTP or admin port an application chose, frequently as the sibling of a service on 9999. Nmap sees it open on about 0.03% of hosts.",
  "exposure": {
    "verdict": "careful",
    "note": "Treat it as an unidentified application port; the registration gives you no security properties to rely on."
  },
  "checkCommand": "nmap -sV -p 9998 TARGET",
  "links": [
    {
      "title": "IANA port registry — 9998 (distinct32)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9998",
      "kind": "iana"
    },
    {
      "title": "nmap-services — Nmap's port frequency database",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}