| Port(s) |
Protocol |
Service |
Scan level |
Description |
| 9083 |
tcp |
emc-pp-mgmtsvc |
not scanned |
EMC PowerPath Mgmt Service |
| 9084 |
tcp,udp,sctp |
aurora |
not scanned |
vSphere Client Update Manager (VUM) uses port 9084/TCP
PC-Telephone Webphone
IBM AURORA Performance Visualizer (IANA official)
|
| 9087 |
tcp,udp |
applications |
not scanned |
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files.
References: [CVE-2021-22018] |
| 9089 |
tcp,udp |
games |
not scanned |
Blitzkrieg, developer: Nival Interactive |
| 9090 |
tcp |
servers |
Members scan |
Cherokee Web Server Admin Panel, Aphex Remote Packet Sniffer, SqueezeCenter control (CLI), Webwasher, Secure Web, McAfee Web Gateway - Default Proxy Port, Openfire Administration Console
Linux browser-based server administration platform (Cockpit Fedora, Arch Linux, CentOS, RHEL) - listens on port 9090 tcp by default (both HTTP and HTTPS connections).
Symantec Endpoint Protection Manager (SEPM) uses this port for initial HTTP communication between a remote management console and the SEPM to display the login screen.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations
RTSP proxy for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a GET request to port 9090 followed by a series of carriage returns, which causes proxy.nlm to ABEND.
References: [CVE-2002-0781]
Multiple HP Intelligent Management Center products could allow a remote attacker to execute arbitrary code on the system, caused by an error in the iNOdeMngChecker.exe component. An attacker could exploit this vulnerability to execute arbitrary code on the system with SYSTEM-level privileges.
References: [XFDB-68348]
SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The `spicedb serve` command contains a flag named `--grpc-preshared-key` which is used to protect the gRPC API from being accessed by unauthorized requests. The values of this flag are to be considered sensitive, secret data. The `/debug/pprof/cmdline` endpoint served by the metrics service (defaulting running on port `9090`) reveals the command-line flags provided for debugging purposes. If a password is set via the `--grpc-preshared-key` then the key is revealed by this endpoint along with any other flags provided to the SpiceDB binary. This issue has been fixed in version 1.19.1. ### Impact All deployments abiding by the recommended best practices for production usage are **NOT affected**: - Authzed's SpiceDB Serverless - Authzed's SpiceDB Dedicated - SpiceDB Operator Users configuring SpiceDB via environment variables are **NOT affected**. Users **MAY be affected** if they expose their metrics port to an untrusted network and are configuring `--grpc-preshared-key` via command-line flag. ### Patches TODO ### Workarounds To workaround this issue you can do one of the following: - Configure the preshared key via an environment variable (e.g. `SPICEDB_GRPC_PRESHARED_KEY=yoursecret spicedb serve`) - Reconfigure the `--metrics-addr` flag to bind to a trusted network (e.g. `--metrics-addr=localhost:9090`) - Disable the metrics service via the flag (e.g. `--metrics-enabled=false`) - Adopt one of the recommended deployment models: [Authzed's managed services](https://authzed.com/pricing) or the [SpiceDB Operator](https://github.com/authzed/spicedb-operator) ### References - [GitHub Security Advisory issued for SpiceDB](https://github.com/authzed/spicedb/security/advisories/GHSA-cjr9-mr35-7xh6) - [Go issue #22085](https://github.com/golang/go/issues/22085) for documenting the risks of exposing pprof to the internet - [Go issue #42834](https://github.com/golang/go/issues/42834) discusses preventing pprof registration to the default serve mux - [semgrep rule go.lang.security.audit.net.pprof.pprof-debug-exposure](https://semgrep.dev/r?q=go.lang.security.audit.net.pprof) checks for a variation of this issue ### Credit We'd like to thank Amit Laish, a security researcher at GE Vernova for responsibly disclosing this vulnerability.
References: [CVE-2023-29193]
WebSM (IANA official) |
| 9090 |
udp |
applications |
not scanned |
MPM SIP HP-180W Wireless IP Phone WE.00.17 allows remote attackers to obtain sensitive information and possibly cause a denial of service via a direct connection to UDP port 9090, which is undocumented and does not require authentication.
References: [CVE-2006-0360], [BID-16285], [SECUNIA-18512]
ZyXel P2000W VoIP 802.11b Wireless Phone running firmware WV.00.02 allows remote attackers to obtain sensitive information, such as MAC address and software version, by directly accessing UDP port 9090.
References: [CVE-2006-0302] [BID-16285] [SECUNIA-18511] [OSVDB-22516] |
| 9091 |
tcp,udp |
apps |
not scanned |
Citrix NetScaler appliance Command Center Server uses ports 9091, 9092, 9094 TCP for communication between client and server, mapping/discovery/administration/configuration management.
Championship Manager 4, Transmission (BitTorrent client) Web Interface, Eyemax DVS-9000 (TCP), Openfire Administration Console (SSL Secured) (TCP)
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9092 |
tcp,udp |
apps |
not scanned |
Amazon AWS MSK uses these TCP ports:
9092, 9094 - TLS
9096, 9196 - ASL/SCRAM
9098, 9198 - IAM access control
Citrix NetScaler appliance Command Center Server uses ports 9091, 9092, 9094 TCP for communication between client and server, mapping/discovery/administration/configuration management.
Championship Manager 4
Apache Kafka - A Distributed Streaming Platform also uses this port (TCP) |
| 9093 |
tcp,udp |
apps |
not scanned |
Championship Manager 03-04
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations
Copycat database replication service [Microtec Informatique] (IANA official) |
| 9094 |
tcp,udp |
apps |
not scanned |
Amazon AWS MSK uses these TCP ports:
9092, 9094 - TLS
9096, 9196 - ASL/SCRAM
9098, 9198 - IAM access control
Citrix NetScaler appliance Command Center Server uses ports 9091, 9092, 9094 TCP for communication between client and server, mapping/discovery/administration/configuration management.
Championship Manager 03-04
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9095 |
tcp,udp |
applications |
not scanned |
Citrix Orchestration uses port 9095 TCP
Networker Web User Interface Server
Directory traversal vulnerability in Remote Console Applet in Halycon Software iASP 1.0.9 allows remote attackers to read arbitrary files via a .. (dot dot) in the HTTP request to port 9095.
References: [CVE-2002-2292], [BID-6394] |
| 9096 |
tcp |
aws |
not scanned |
Amazon AWS MSK uses these TCP ports:
9092, 9094 - TLS
9096, 9196 - ASL/SCRAM
9098, 9198 - IAM access control |
| 9098 |
tcp |
aws |
not scanned |
Amazon AWS MSK uses these TCP ports:
9092, 9094 - TLS
9096, 9196 - ASL/SCRAM
9098, 9198 - IAM access control |
| 9099 |
tcp |
|
not scanned |
HP Laserjet printers with JetDirect cards, when configured with TCP/IP, allow remote attackers to bypass print filters by directly sending PostScript documents to TCP ports 9099 and 9100.
References: [CVE-1999-1062] |
| 9100 |
udp |
games |
not scanned |
Company Of Heroes, Tom Clancy's Splinter Cell: Conviction |
| 9100 |
tcp |
applications |
not scanned |
Abacast peer-to-peer audio and video streaming, PDL Data Stream
9100/tcp - Prometheus Node exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations
The default configuration of some HP Printers and HP Digital Sender enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.
References: [CVE-2011-4161] [BID-51324]
Kyocera 3830 (aka FS-3830N) printers have a back door that allows remote attackers to read and alter configuration settings via strings that begin with "!R!SIOP0", as demonstrated using (1) a connection to to TCP port 9100 or (2) the UNIX lp command.
References: [CVE-2006-0788] [BID-16685] [SECUNIA-18896] [OSVDB-23245]
HP Laserjet printers with JetDirect cards, when configured with TCP/IP, allow remote attackers to bypass print filters by directly sending PostScript documents to TCP ports 9099 and 9100.
References: [CVE-1999-1062]
On EPSON WF-2750 printers with firmware JP02I2, there is no filtering of print jobs. Remote attackers can send print jobs directly to the printer via TCP port 9100.
References: [CVE-2018-14900]
p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100.
References: [CVE-2018-10123], [EDB-44635]
An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device. A malformed PJL variable FORMLINES is set to a non number value causing the target to crash.
References: [CVE-2024-51982] |
| 9101 |
udp |
games |
not scanned |
Company of Heroes: Opposing Fronts
Bacula Director (TCP/UDP) (IANA official) |
| 9101 |
tcp |
prometheus |
not scanned |
HP JetDirect card
9101/tcp - Prometheus HAProxy exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9102 |
tcp,udp |
bacula-fd |
not scanned |
Splinter Cell Splinter Cell Chaos Theory (game)
HP JetDirect card
Bacula File Daemon (IANA official) |
| 9103 |
udp |
games |
not scanned |
Supreme Commander, Tom Clancy's Splinter Cell: Conviction
Blood Bowl also uses this port (TCP/UDP)
Settlers 7 game ports: 13005, 13200 TCP and 3544, 9103, 13005, 21000-29999 UDP
Bacula Storage Daemon (TCP/UDP) (IANA official) |
| 9103 |
tcp |
prometheus |
not scanned |
9103/tcp - Prometheus Collectd exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9104 |
tcp |
apps |
not scanned |
9104/tcp - Prometheus MySQLd exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations
HP JetDirect card
PeerWire (IANA official) |
| 9105 |
tcp,udp |
xadmin |
not scanned |
Xadmin Control Service
Operation Flashpoint: Dragon Rising also uses port 9105 (UDP), developer: Codemasters
9105/tcp - Prometheus Mesos exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9106 |
tcp |
astergate |
not scanned |
Astergate Control Service
9106/tcp - Prometheus CloudWatch exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9106 |
udp |
astergate-disc |
not scanned |
Astergate Discovery Service |
| 9107 |
tcp |
astergatefax |
not scanned |
AstergateFax Control Service
9107/tcp - Prometheus Consul exporter.
Prometheus (open-source system monitoring) uses these TCP ports:
9090 (server)
9091 (Pushgateway)
9093 (Alertmanager)
9094 (Alertmanager clustering)
9100-9563 - Prometheus Exporters
See: https://github.com/prometheus/prometheus/wiki/Default-port-allocations |
| 9110 |
udp |
applications |
not scanned |
SSMP Message protocol
Compuware DriverStudio Remote Control service (DSRsvc.exe) 2.7 and 3.0 beta 2 allows remote attackers to cause a denial of service (reboot) via a UDP packet sent directly to port 9110.
References: [CVE-2005-3035], [BID-14838] |
| 9111 |
tcp |
hexxorecore |
not scanned |
HP StorageWorks File Migration Agent (FMA) is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the HsmCfgSvc.exe service when processing CIFS archive names. By sending a specially-crafted packet to TCP port 9111, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
References: [XFDB-77089], [BID-54595]
IANA registered for: Multiple Purpose, Distributed Message Bus (TCP/UDP) |
| 9112 |
tcp |
applications |
not scanned |
Eyemax DVS-9000 |
| 9117 |
tcp |
|
Premium scan |
Jackett (Linux proxy server for http query translations) uses port 9117 by default
Massaker trojan [Symantec-2003-011614-4100-99] |
| 9119 |
tcp,udp |
mxit |
not scanned |
MXit Instant Messaging (IANA official) |
| 9120 |
tcp,udp |
applications |
not scanned |
In Flexense Disk Pulse Enterprise v10.1.18, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.
References: [CVE-2017-15663], [EDB-43452], [EDB-43589], [XFDB-137273] |
| 9121 |
tcp |
applications |
not scanned |
A buffer overflow vulnerability in the control protocol of Flexense SyncBreeze Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9121.
References: [CVE-2018-6537], [EDB-43936]
In Flexense Sync Breeze Enterprise v10.1.16, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.
References: [CVE-2017-15664], [EDB-43453] |
| 9122 |
tcp |
grcmp |
not scanned |
Global Relay compliant mobile instant messaging protocol [Global_Relay] (IANA official) |
| 9123 |
tcp |
grcp |
not scanned |
Global Relay compliant instant messaging protocol (IANA official)
In Flexense VX Search Enterprise v10.1.12, the Control Protocol suffers from a denial of service vulnerability. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.
References: [CVE-2017-15662], [EDB-43451], [XFDB-137295] |
| 9124 |
tcp,udp |
trojans |
not scanned |
Backdoor.Fox [Symantec-2002-071517-2053-99] (2002.07.15) - gives a hacker full remote access to the comnputer
A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9124.
References: [CVE-2018-6481], [EDB-44156] |
| 9125 |
tcp |
trojans |
Premium scan |
Backdoor.Nibu.J [Symantec-2005-032410-4542-99] - back door and a keylogger, periodically sending the stolen info via email. Listens on port 9125/tcp for instructions from a remote attacker.
Backdoor.Nibu.N [Symantec-2005-081216-4542-99] - a trojan that blocks access to security-related sites, and opens a backdoor on the compromised computer. It also runs a keylogger, sending information periodically via email. Opens a backdoor and listens for remote commands on ports 9125/tcp, and 27328/tcp.
Backdoor.Nibu.L [Symantec-2005-062110-3427-99] - trojan that opens a backdoor and blocks access to security-related websites and runs a keylogger, periodically sending the information to a remote attacker. Opens a backdoor on port 9125/tcp. |
| 9148 |
tcp |
trojan |
Premium scan |
Nautical trojan |
| 9150 |
tcp |
applications |
not scanned |
Tor (The Onion Router) anonymity network - conceals traffic by directing it through a free worldwide volunteer network of thousands of relays. |
| 9191 |
tcp |
applications |
not scanned |
Heap-based buffer overflow in SW3eng.exe in the eID Engine service in CA (formerly Computer Associates) eTrust Intrusion Detection and earlier allows remote attackers to cause a denial of service (application crash) via a long key length value to the remote administration port (9191/tcp).
References: [CVE-2007-1005], [BID-22743]
Sierra Wireless Airlink uses port 9191/TCP
PaperCut (print management system) uses these ports:
9191/tcp - HTTP
9192/tcp - HTTPS
9193/tcp - RPC (only for embedded copier/MFP solutions)
Sun AppSvr JPDA (old IANA registration)
Catamount Software - PocketMoney Sync (IANA official) |
| 9192 |
tcp |
papercut |
not scanned |
PaperCut (print management system) uses these ports:
9191/tcp - HTTP
9192/tcp - HTTPS
9193/tcp - RPC (only for embedded copier/MFP solutions) |
| 9193 |
tcp |
papercut |
not scanned |
PaperCut (print management system) uses these ports:
9191/tcp - HTTP
9192/tcp - HTTPS
9193/tcp - RPC (only for embedded copier/MFP solutions) |
| 9196 |
tcp |
aws |
not scanned |
Amazon AWS MSK uses these TCP ports:
9092, 9094 - TLS
9096, 9196 - ASL/SCRAM
9098, 9198 - IAM access control |
| 9198 |
tcp |
aws |
not scanned |
Amazon AWS MSK uses these TCP ports:
9092, 9094 - TLS
9096, 9196 - ASL/SCRAM
9098, 9198 - IAM access control |
| 9199 |
tcp |
applications |
not scanned |
Avtex LLC - qStats |
| 9200 |
tcp,udp |
wsp |
not scanned |
Elasticsearch listens on ports 9200 and 9300 TCP
Starlink gRPC uses ports 9200 and 9201 TCP
Some Lexmark printers open port 9200 TCP/UDP
WapServ Lite, WapServ Pro and WapServ Enterprise are vulnerable to a denial of service. By sending specific byte values over port 9200 or port 9201, a remote attacker can cause the gateway to consume large amounts of memory resources, prevent the gateway from starting, or cause the gateway to crash.
References: [BID-8472], [XFDB-13011]
File Replication Pro could allow a remote attacker to execute arbitrary commands on the system, caused by an error in the ExecCommand function. By viewing configuration.xml, an attacker could exploit this vulnerability to send specially-crafted packet to port 9200 to execute arbitrary commands on the system.
References: [XFDB-110638]
WAP Connectionless Wireless Session Protocol (TCP/UDP) [WAP Forum] (IANA official) |
| 9201 |
tcp,udp |
applications |
not scanned |
Starlink gRPC uses ports 9200 and 9201 TCP
WapServ Lite, WapServ Pro and WapServ Enterprise are vulnerable to a denial of service. By sending specific byte values over port 9200 or port 9201, a remote attacker can cause the gateway to consume large amounts of memory resources, prevent the gateway from starting, or cause the gateway to crash.
References: [BID-8472], [XFDB-13011]
WAP session service [WAP Forum] (IANA official) |
| 9202 |
tcp,udp |
wap-wsp-s |
not scanned |
WAP secure connectionless session service [WAP Forum] (IANA official) |
| 9203 |
tcp,udp |
wap-wsp-wtp-s |
not scanned |
WAP secure session service [WAP Forum] (IANA official) |
| 9204 |
udp |
applications |
not scanned |
HTC Touch Pro and HTC Touch Cruise vCard allows remote attackers to cause denial of service (CPU consumption, SMS consumption, and connectivity loss) via a flood of vCards to UDP port 9204.
References: [CVE-2008-6775]
WAP vCard (TCP/UDP) [WAP Forum] (IANA official) |
| 9205 |
tcp,udp |
wap-vcal |
not scanned |
WAP vCal [WAP_Forum] (IANA official) |
| 9206 |
tcp,udp |
wap-vcard-s |
not scanned |
WAP vCard Secure [WAP Forum] (IANA official) |
| 9207 |
tcp,udp |
wap-vcal-s |
not scanned |
WAP vCal Secure [WAP Forum] (IANA official) |
| 9217 |
tcp,udp |
fsc-port |
not scanned |
iPass Platform Service (TCP)
IANA registered for: FSC Communication Port |
| 9221 |
tcp,udp |
applications |
not scanned |
The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system-level access because of a Buffer Overflow.
References: [CVE-2018-5359], [EDB-43588]
In Flexense SysGauge Server 3.6.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9221.
References: [CVE-2017-15667], [EDB-43403], [XFDB-136840]
Flexense Sync Breeze Enterprise is vulnerable to a denial of service, caused by a flaw in the control protocol. By sending a specially crafted SERVER_GET_INFO packet to control port 9121, a remote attacker could exploit this vulnerability to cause the application to crash.
References: [CVE-2017-15664], [XFDB-137392] |
| 9222 |
tcp |
debug |
not scanned |
Port often used for remote debugging - Microsoft Edge DevTools Protocol
IANA Registered for: QSC Team Coherence |
| 9229 |
tcp |
applications |
not scanned |
NodeJS debugging default port (localhost) |
| 9251 |
tcp,udp |
applications |
not scanned |
QNAP QTS could allow a remote attacker to execute arbitrary commands on the system, caused by a flaw in the transcoding service on port 9251. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
References: [CVE-2017-13067], [XFDB-132062] |
| 9256 |
udp |
applications |
not scanned |
Achat is vulnerable to a SEH-based stack buffer overflow, caused by improper bounds checking by AChat.exe. By sending a specially-crafted UDP packet to the default port 9256 to overwrite the SEH handler, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
References: [EDB-36056], [XFDB-100845] |
| 9264 |
tcp |
fmod |
not scanned |
FMOD Studio profiler protocol listens on port 9264/TCP
|
| 9277 |
udp |
traingpsdata |
not scanned |
GPS Data transmitted from train to ground network [Alstom_Transport_Preston] (IANA official) |
| 9278 |
tcp,udp |
pegasus |
not scanned |
Pegasus GPS Platform |
| 9279 |
tcp,udp |
pegasus-ctl |
not scanned |
Pegaus GPS System Control Interface |
| 9284 |
tcp,udp |
applications |
not scanned |
Netris 0.5, and possibly other versions before 0.52, when running with the -w (wait) option, allows remote attackers to cause a denial of service (crash) via a long string to port 9284.
References: [BID-5680], [CVE-2002-1566], [XFDB-10081]
Port is also IANA registered for VERITAS Information Server |
| 9286 |
udp |
n2receive |
not scanned |
IANA registered for: n2 monitoring receiver |
| 9293 |
tcp,udp |
storview |
not scanned |
Sony Playstation RemotePlay (TCP)
StorView Client (IANA official) |
| 9295 |
tcp,udp |
applications |
not scanned |
Sony PlayStation Remote Play Session creation communication port |
| 9296 |
udp |
applications |
not scanned |
Sony PlayStation Remote Play |
| 9300 |
tcp |
vrace |
not scanned |
Elasticsearch listens on ports 9200 and 9300 TCP
IBM Cognos 8 SOAP Business Intelligence and Performance Management
IANA registered for: Virtual Racing Service |
| 9301 |
tcp |
trojans |
Premium scan |
DLP, LoseLove |
| 9303 |
udp |
applications |
not scanned |
D-Link Shareport Share storage and MFP printers |
| 9306 |
tcp |
sphinxql |
not scanned |
Sphinx search server (MySQL listener) |
| 9309 |
tcp,udp |
applications |
not scanned |
Sony PlayStation Vita Host Collaboration WiFi Data Transfer |
| 9310 |
tcp |
sapms |
not scanned |
IANA registered for: SAP Message Server |
| 9312 |
tcp |
sphinxapi |
not scanned |
Sphinx search server |
| 9319 |
tcp |
applications |
not scanned |
EMC Networker could allow a remote attacker to execute arbitrary code on the system, caused by a format string vulnerability in librpc.dll within the nsrd RPC service. By sending a specially-crafted request containing malicious format string specifiers to TCP port 9319, a remote attacker could exploit this vulnerability to execute arbitrary code on the vulnerable system or cause the application to crash.
References: [XFDB-78187], [BID-55330] |
| 9324 |
tcp |
google |
not scanned |
Google Assistant docker containers commonly run a webserver listening for HTTP requests on TCP ports 9324 and 5000. |
| 9325 |
udp |
trojan |
not scanned |
Mstream trojan
DDOS communication also uses this port |
| 9329 |
tcp |
trojan |
Premium scan |
DLP trojan |
| 9329 |
udp |
malware |
not scanned |
Backdoor.Win32.Loselove / Denial of Service - the malware listens on UDP ports 9329, 8329, 8322, 8131 and 8130. Attackers can send a large junk payload to UDP port 8131 causing it to crash.
References: [MVID-2022-0554] |
| 9332 |
tcp |
applications |
not scanned |
Litecoin JSON-RPC server |
| 9333 |
tcp |
cryptocurrency |
Premium scan |
Litecoin cryptocurrency uses port 9333.
Common cryptocurrency ports (TCP):
Bitcoin: 8333
Litecoin: 9332,9333
Dash: 9999
Dogecoin: 22556
Ethereum: 30303 |
| 9339 |
tcp |
games |
not scanned |
Used by all Supercell games such as Brawl Stars and Clash of Clans, mobile freemium strategy video games
IANA registered for: gRPC Network Mgmt/Operations Interface |
| 9340 |
tcp |
gribi |
not scanned |
gRPC Routing Information Base Interface (IANA official) |
| 9345 |
tcp |
rancher |
not scanned |
Rancher Agent (IANA official) |
| 9393 |
tcp,udp |
applications |
not scanned |
TalkSwitch |
| 9400 |
tcp |
trojan |
Premium scan |
InCommand trojan |
| 9401 |
tcp |
trojan |
Premium scan |
InCommand trojan |
| 9402 |
tcp |
trojan |
Premium scan |
InCommand trojan |
| 9415 |
tcp |
applications |
not scanned |
Port used by PPLive P2P online streaming TV service. PPLive is prone to an open proxy vulnerability because of an insecure default configuration. A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.
References: [BID-47508] |
| 9418 |
tcp,udp |
git |
not scanned |
git pack transfer service (IANA official) |
| 9419 |
tcp |
moosefs |
not scanned |
MooseFS distributed file system uses these ports:
9419 -> MooseFS master control port
9420 -> MooseFS master command port
9421 -> MooseFS master client port
9422 -> MooseFS Chunkservers
9425 -> MooseFS CGI server
|
| 9420 |
tcp |
moosefs |
not scanned |
MooseFS distributed file system uses these ports:
9419 -> MooseFS master control port
9420 -> MooseFS master command port
9421 -> MooseFS master client port
9422 -> MooseFS Chunkservers
9425 -> MooseFS CGI server
|
| 9421 |
tcp |
moosefs |
not scanned |
MooseFS distributed file system uses these ports:
9419 -> MooseFS master control port
9420 -> MooseFS master command port
9421 -> MooseFS master client port
9422 -> MooseFS Chunkservers
9425 -> MooseFS CGI server
|
| 9422 |
tcp |
moosefs |
not scanned |
MooseFS distributed file system uses these ports:
9419 -> MooseFS master control port
9420 -> MooseFS master command port
9421 -> MooseFS master client port
9422 -> MooseFS Chunkservers
9425 -> MooseFS CGI server
|
| 9425 |
tcp |
moosefs |
not scanned |
MooseFS distributed file system uses these ports:
9419 -> MooseFS master control port
9420 -> MooseFS master command port
9421 -> MooseFS master client port
9422 -> MooseFS Chunkservers
9425 -> MooseFS CGI server
|
| 9427 |
tcp |
applications |
not scanned |
VMWare Blast Extreme
Windows Multi Media (MMR) and USB redirection
Optional for client drive redirection (CDR) and multimedia redirection (MMR). |
| 9442 |
udp |
games |
not scanned |
Need For Speed |
| 9443 |
tcp |
tungsten-https |
Premium scan |
Sometimes used as an alternate SSL port.
Dogtag Certificate System authority uses port 9080 (ca) and port 9443 (secure ca) by default.
Dograg Certificate PKI Subsystems may also use:
DRM - ports 10080 (drm) and 10443 (drm secure)
OCSP - ports 11080 (ocsp) and 11443 (ocsp secure)
RA - ports 12888 (ra) and 12889 (ra secure)
TKS - ports 13080 (tks) and 13443 (tks secure)
TPS - ports (tps) 7888 and 7889 (tps secure)
German Health Getwork (aka Gesundheitskarte) "Konnektor" uses ports 8443 and 9443.
VMware HTTPS uses port 9443 (TCP) for accessing and administrating a vCenter Server via the Web Management Interface
Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.0 allows remote attackers to cause a denial of service (CPU consumption and monitoring outage) via malformed TLS messages to TCP port (1) 9043 or (2) 9443, aka Bug ID CSCuc07155.
References: [CVE-2013-1135]
Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.
References: [CVE-2019-17134]
OpenNMS is accessible via port 9443
References: [CVE-2020-1652]
WSO2 Tungsten HTTPS (IANA official) |
| 9443 |
udp |
fortiguard |
not scanned |
Fortinet FortiGate uses the following ports (in addition to standard ports 53, 80, 443):
514 tcp - FortiAP logging and reporting
541 tcp, 542 tcp - FortiGuard management
703 tcp/udp. 730 udp - FortiGate heartbeat
1000 tcp, 1003 tcp - policy override keepalive
1700 tcp - FortiAuthenticator RADIUS disconnect
5246 udp - FortiAP-S event logs
8000, 8001 tcp - FortiClient SSO mobility agent
8008, 8010 tcp - policy override authentication
8013 tcp - FortiClient v.5.4
8014 tcp - Forticlient v.6
8890 tcp - AV/IPS updates, management, firmware
9443 udp - AV/IPS
9582 tcp - FortiGuard Cloud App DB (flow.fortinet.net)
|
Shortcuts