Internet-Security raven logo internet-security.com

TCP 8172

ProtocolTCP
Port8172
LabelsMicrosoft Remote Administration for IIS Manager

Synopsis

  • TCP 8172 is the default port for Microsoft IIS Web Management Service (WMSVC), which provides remote administration over HTTPS on Windows Server IIS 7 and later.
  • IIS Manager for Remote Administration connects to https://server:8172 to manage IIS sites and settings.
  • Microsoft Web Deploy (msdeploy) uses 8172 when publishing to IIS via WMSVC; tools like Visual Studio, Azure DevOps pipelines, Octopus Deploy, and Plesk on Windows use https://server:8172/msdeploy.axd to push site packages.
  • Many IIS-based hosting and enterprise environments expose 8172 to enable remote website and application publishing.
  • Security note: exposed 8172/WMSVC endpoints are commonly scanned and have been abused for credential brute-forcing and, once accessed, for deploying web shells or malicious packages via msdeploy.

Observed activity

Last 30 days Detailed chart

More information