Internet-Security raven logo internet-security.com

TCP 5672

ProtocolTCP
Port5672
LabelsAdvanced Message Queuing Protocol (AMQP)

Synopsis

  • TCP port 5672 is the default port for AMQP (Advanced Message Queuing Protocol) without TLS.
  • RabbitMQ commonly listens on 5672 for AMQP 0-9-1/1.0 traffic (with 5671 for TLS).
  • Apache Qpid brokers (qpidd and Qpid Broker-J) use 5672 for AMQP message traffic.
  • Apache ActiveMQ Artemis exposes AMQP 1.0 on 5672 by default; Red Hat AMQ (based on Artemis/Qpid) does the same.
  • Amazon MQ managed brokers provide AMQP endpoints on 5672 for both RabbitMQ and ActiveMQ/Artemis deployments.
  • Solace PubSub+ event brokers support AMQP 1.0 on 5672 (and 5671 for TLS).
  • IBM MQ’s AMQP feature (formerly MQ Light) uses 5672 as its default listener.
  • Security note: attackers frequently scan for exposed AMQP on 5672 and have abused misconfigured or vulnerable brokers (e.g., RabbitMQ or ActiveMQ/Artemis) via weak credentials or known CVEs to deploy malware or move laterally.

Observed activity

Last 30 days Detailed chart

More information