TCP 5431
Synopsis
- TCP port 5431 is commonly used by the UPnP Internet Gateway Device (IGD) SOAP control service on some consumer routers/gateways.
- Real-world examples include many Belkin home routers and other ISP-supplied CPE based on Broadcom firmware (e.g., models from Linksys and D‑Link) that expose their UPnP control interface on 5431/TCP.
- This port has been actively abused: the UPnProxy campaigns scanned 5431/TCP to find WAN-exposed UPnP services and injected malicious NAT rules to turn routers into anonymizing proxies; IoT botnets have also probed 5431 for vulnerable UPnP implementations.
- Outside of UPnP IGD on such routers, there is no broadly adopted, well-known software that consistently uses TCP/5431 on the public internet.
Observed activity
Last 30 days
Detailed chart