{
  "port": 9999,
  "protocol": "both",
  "service": "distinct / alternate HTTP",
  "oneLiner": "Registered as \"distinct\", but in practice the most common ad-hoc admin or alternate-HTTP port above 9000.",
  "whatItIs": "IANA registers 9999 as distinct, assigned to Distinct Corporation, with 9998 as distinct32 — a registration you will not meet in the field. What actually answers on 9999 is an HTTP service someone parked on a memorable number: Nmap's database labels it abyss, the Abyss Web Server's remote management console, and the port is a perennial favourite for debug endpoints, appliance UIs, and second web servers. At roughly 0.44% of scanned hosts, it is by far the busiest port in this range.",
  "exposure": {
    "verdict": "careful",
    "note": "Because it is almost always an ad-hoc HTTP surface rather than a standard protocol, assume it is a management interface until proven otherwise — and a management interface on a public IP is a never."
  },
  "checkCommand": "curl -sSI http://TARGET:9999/",
  "links": [
    {
      "title": "IANA port registry — 9999 (distinct)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9999",
      "kind": "iana"
    },
    {
      "title": "nmap-services — Nmap's port frequency database",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}