Internet-Security raven logo internet-security.com

TCP 1080

ProtocolTCP
Port1080
LabelsSOCKS proxy

Synopsis

  • TCP port 1080 is the conventional port for the SOCKS proxy protocol (SOCKS4/5, RFC 1928).
  • Dedicated SOCKS servers such as Dante and 3proxy typically listen on 1080.
  • Microsoft Proxy Server/ISA Server/Forefront TMG offered a “Winsock Proxy” (SOCKS) service that used TCP 1080.
  • MikroTik RouterOS includes a built-in SOCKS proxy whose default port is 1080 (ip socks set port=1080).
  • Tunneling tools often expose a local SOCKS5 proxy on 1080, including OpenSSH dynamic forwarding (ssh -D 1080), Shadowsocks/shadowsocks-libev clients, and V2Ray (common example configs use port 1080).
  • Many applications are configured to connect to upstream SOCKS proxies on 1080 in practice, e.g., web browsers, qBittorrent, and curl.
  • Port 1080 is frequently abused when left open: attackers scan for open SOCKS proxies and have enabled SOCKS on compromised devices (e.g., MikroTik routers after CVE-2018-14847) to relay spam, credential-stuffing, and for pivoting/C2.

Observed activity

Last 30 days Detailed chart

More information