TCP 2096
Synopsis
- TCP port 2096 is widely used by cPanel/WHM for secure Webmail (HTTPS).
- It serves cPanel’s Webmail interface (Roundcube, historically Horde) at URLs like https://yourdomain:2096/.
- Hosting providers that deploy cPanel (e.g., HostGator, Bluehost, A2 Hosting, GoDaddy cPanel plans) expose 2096 for customer webmail access.
- Cloudflare includes 2096 in its list of supported HTTPS ports, commonly used to proxy cPanel Webmail through Cloudflare to the origin server.
- cPanel firewall guides (e.g., CSF or firewalld configurations) explicitly require opening TCP 2096 for secure webmail.
- Because it fronts cPanel login pages, attackers frequently scan/brute-force services on 2096 to steal webmail credentials.
Observed activity
Last 30 days
Detailed chart