Internet-Security raven logo internet-security.com

TCP 9000

ProtocolTCP
Port9000
LabelsHadoop NameNode

Synopsis

  • SonarQube server exposes its web UI on TCP 9000 by default.
  • ClickHouse database uses TCP 9000 for its native client protocol.
  • MinIO object storage serves its S3-compatible API on TCP 9000 (console often on 9001).
  • PHP-FPM commonly listens on 127.0.0.1:9000 for FastCGI connections from Nginx/Apache.
  • Portainer’s Docker/Kubernetes management UI has historically run on TCP 9000 (with newer versions using 9443 for HTTPS).
  • Graylog’s web interface typically binds to TCP 9000.
  • Logitech Media Server (Squeezebox) provides its web UI on TCP 9000.
  • Twonky media server exposes its administration/web UI on TCP 9000.
  • CMAK (Kafka Manager) runs its web console on TCP 9000.
  • Because of these services, attackers often scan TCP 9000 for exposed PHP-FPM (FastCGI) endpoints enabling remote code execution and for misconfigured Portainer/MinIO instances.

Observed activity

Last 30 days Detailed chart

More information