Internet-Security.com TCP port 2221 details

ESET Remote Administrator (ERA) 5.x uses TCP port 2221 for its built‑in HTTP Mirror service that distributes antivirus definition updates and installers to ESET Endpoint clients (e.g., clients configured to update from http://eraserver:2221).
In multi-site ERA 5 deployments, organizations commonly opened 2221/TCP so remote offices could retrieve updates from the central ERA Mirror.
Newer ESET management platforms (ESMC/PROTECT) typically do not use 2221 by default, relying instead on ports like 2222/2223, so 2221 is mainly a legacy ERA 5 port.

TCP 2221