Internet-Security.com TCP port 5280 details

TCP port 5280 is widely used by XMPP servers for HTTP-based services such as BOSH (XMPP over HTTP) and WebSocket.
ejabberd uses 5280 by default for its HTTP listener, serving the Web Admin (/admin), REST API (/api), BOSH (/http-bind or /bosh), file upload endpoints, and WebSocket (/ws).
Prosody uses 5280 by default for its built-in HTTP server, commonly providing BOSH (/http-bind), WebSocket (/xmpp-websocket), HTTP file upload, and the optional mod_admin_web interface.
MongooseIM (an XMPP server) also exposes BOSH, WebSocket, and its REST/management HTTP endpoints on 5280 by default in standard configurations.
Because 5280 often hosts admin or API interfaces for these servers, exposed instances are sometimes targeted for default-credential attacks or exploitation of known XMPP server vulnerabilities.

TCP 5280