8080
Summary
- // if you see it open
- Same web-application attack surface as port 80 but frequently less hardened: exposed unauthenticated dev servers, misconfigured open proxies (relay abuse), exposed Tomcat Manager / appliance consoles. Very common malware C2 alternate port (MITRE ATT&CK T1571 Non-Standard Port; used by Emotet in hardcoded C2 configs).
- // common applications
- Apache TomcatJettySquidNode.jsSpring Boot
- // analyst note
- An open 8080 almost always means an HTTP service; enumerate the banner/title. An exposed unauthenticated app server or open proxy is the main risk.
About port 8080/tcp.
Port 8080/tcp is the internet's universal "second HTTP port," registered with IANA as http-alt with the description "HTTP Alternate (see port 80)" for both 8080/tcp and 8080/udp; the IANA reference field is blank, so no RFC is tied to the assignment. The convention exists for a practical reason: on Unix-like systems, binding a port below 1024 requires root privileges, so developers, proxies, and application servers adopted a high, non-privileged port whose number visually echoes 80. It carries ordinary HTTP (HTTP/1.1, and HTTP/2 where configured) — there is no protocol difference from port 80, and crucially no implied encryption (8080 is not HTTPS). In practice 8080 is the default HTTP connector for Apache Tomcat and Jetty, the default for Jenkins and Spring Boot, a conventional forward/caching-proxy port (Squid and others), and the go-to port for development and staging servers. Security-wise, 8080 sees the same web-application attack surface as port 80 but is frequently less hardened: exposed dev servers without authentication, misconfigured open proxies that enable relay abuse, and internet-facing Tomcat Manager or appliance admin consoles. It is also one of the most common malware command-and-control alternate ports — MITRE ATT&CK lists 8080 under T1571 (Non-Standard Port), and families such as Emotet have used it in hardcoded C2 configurations. For an analyst, an open 8080 almost always indicates an HTTP service; grab the banner and page title, and treat an exposed unauthenticated app server or open proxy as the primary risk.
- IANA assignment
http-alt— "HTTP Alternate (see port 80)"; reference (blank — no RFC cited in IANA registry); registered for 8080/tcp and 8080/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry- Range class
- registered (1024–49151)
- Prevalence
- among the most common open TCP ports; in Nmap's default top-1000 set (de-facto, nmap-services) [Well-established] — nmap-services file
- Related ports
- 80 (HTTP), 443/8443 (HTTPS), 8000 & 8888 (other HTTP-alt), 3128 (Squid)
Primary use
alternate HTTP listener — proxies, app servers, dev servers
Other/unofficial uses
Tomcat/Jetty default HTTP connector; Jenkins; Spring Boot; Squid forward proxy; web admin UIs [Well-established]
Security implications
same web-app risks as port 80 but often less hardened; open-proxy relay abuse; exposed dev servers and Tomcat Manager; very common malware C2 alt-port (MITRE T1571; Emotet)
Typically seen on
web servers, reverse proxies, application servers, appliance admin UIs, Docker/Kubernetes service ports
- Analyst note
- An open 8080 almost always means an HTTP service; enumerate the banner/title. An exposed unauthenticated app server or open proxy is the main risk.
About port 8080/udp.
Port 8080/udp shares its IANA registration with the far better-known 8080/tcp: both are listed in the IANA Service Name and Transport Protocol Port Number Registry under the service name http-alt with the description "HTTP Alternate (see port 80)" and assignee Stephen Casner, and the reference field is blank, so no RFC is tied to the assignment. That dual tcp/udp registration is the near-total extent of what can be verified for the UDP transport. Unlike 8080/tcp — the internet's universal "second HTTP port," the default connector for Tomcat, Jetty, Jenkins, and Spring Boot, a conventional Squid proxy port, and a very common malware C2 alt-port — 8080/udp has no comparable established practical convention. Standard web traffic (HTTP/1.1, HTTP/2) is TCP-based, and the UDP transport for modern web (QUIC / HTTP/3) conventionally runs on UDP 443, not UDP 8080; no QUIC-on-8080 convention could be found. Internet-scale UDP reconnaissance concentrates on DNS (53), SNMP (161/162), and DHCP (67/68), and 8080/udp is not called out as a notable UDP scanning target. Any UDP traffic seen on port 8080 is therefore more likely an application-specific choice echoing the familiar "8080" number than a recognized standard service. For an analyst, the honest posture is that the formal http-alt label exists on UDP but has no verified real-world use; a live UDP/8080 responder warrants case-by-case inspection (banner, owning process, reflection/amplification potential) rather than an assumption of HTTP-alternate traffic.
- IANA assignment
http-alt— "HTTP Alternate (see port 80)"; reference (blank — no RFC cited in IANA registry); registered for both 8080/tcp and 8080/udp under identical service name/description/assignee [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local cached CSV; https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8080)- Range class
- registered (1024–49151) [Confirmed] — port number falls in the IANA registered range
- Prevalence
- Unknown for the UDP transport — no sourced nmap-services UDP open-frequency or scan-census figure specific to 8080/udp was found [Unknown]
- Related ports
- 8080/tcp (the practically-used sibling under the same http-alt registration); 80 (HTTP), 443 (HTTPS / QUIC UDP), 8443, 8000 & 8888 (other HTTP-alt)
Primary use
none established for the UDP transport — the http-alt label applies formally but no real-world UDP/8080 convention could be verified
Other/unofficial uses
Unknown — no specific software or daemon identified that conventionally binds UDP/8080; QUIC/HTTP-3 uses UDP 443, not 8080
Security implications
Unknown / not specifically reported — 8080/udp is not called out as a common UDP scan target (internet UDP recon concentrates on DNS 53, SNMP 161/162, DHCP 67/68); the TCP entry's C2 context (MITRE ATT&CK T1571, Emotet) is TCP-specific and is NOT carried over. Any exposed UDP responder should be checked case-by-case for reflection/amplification potential
Typically seen on
Unknown — no established host/service class for UDP/8080
- Assignee / contact
- Stephen Casner (
[Stephen_Casner]) [Confirmed] — IANA registry CSV - Analyst note
- The IANA http-alt registration applies to UDP but has no verified practical use. Treat a live UDP/8080 responder as an unknown application service worth inspecting (owning process, banner, reflection/amplification risk), not as assumed HTTP-alternate traffic.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| http-proxy | TCP | Common HTTP proxy/second web server port | 4.21% |
| http-alt | UDP | HTTP Alternate (see port 80) | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.