TCP 9040
Synopsis
- Tor daemon: TCP 9040 is widely used as Tor’s TransPort (transparent proxy) port.
- Real-world examples: Tails (amnesic OS) routes local TCP traffic to Tor via TransPort 9040; Whonix Gateway uses 9040 for transparent Tor routing; OpenWrt, pfSense, and OPNsense Tor packages commonly configure TransPort on 9040; many Linux torrc samples set TransPort 9040 by default.
- Purpose: local firewall rules (iptables/nftables/pf) redirect connections to 9040 so applications are transparently proxied over the Tor network.
- Security note: This port is sometimes seen in malicious setups where malware or illegal proxy services bundle Tor and expose a TransPort on 9040 to anonymize command-and-control or traffic, though it’s also widely used for legitimate privacy.
Observed activity
Last 30 days
Detailed chart