TCP Port 8080 – HTTP Alternate (alt-HTTP)
Port 8080 is the most common alternative port for HTTP web traffic, registered in IANA as “http-alt” (HTTP Alternate). It runs the same Hypertext Transfer Protocol as port 80, but on a port that does not require administrator or root privileges to open on most operating systems. That single property is why port 8080 became a standard convention rather than just an arbitrary high-numbered port.
Port 8080 shows up most often in three contexts. First, application servers: Apache Tomcat, JBoss, and many Java application servers default to port 8080 for their web interfaces. Second, development environments: a developer running a local web server while building an application typically lands on 8080 (or 3000, or 5000) since those high ports do not require elevated privileges. Third, web admin interfaces on consumer hardware: home routers, network printers, NAS devices, and IP cameras frequently expose configuration pages on port 8080.
When port 8080 is part of a production deployment, it is almost always behind a reverse proxy. The application server listens on 8080 internally, and a front-end web server (Nginx, Apache HTTPD, or a cloud load balancer) accepts incoming HTTPS connections on port 443 and forwards them to 8080 on the application server. Users do not typically connect to port 8080 directly across the public internet.
Outbound TCP/8080 from end-user devices is uncommon outside specific cases (corporate proxies, certain SaaS configurations). Inbound TCP/8080 to a host that is not an application server, development environment, or administrative endpoint is unusual and worth investigating.
About TCP Port 8080
The Internet Assigned Numbers Authority (IANA) registers port 8080 for http-alt. The IANA description reads: ‘HTTP Alternate (see port 80)’.
Security Considerations
Port 8080 inherits the entire web-application threat landscape from port 80. Our data shows 2,086 IDS rules referencing this port, with web-application-attack and web-application-activity classtypes leading at over 800 rules combined. Many of the same malware families appear, including Emotet (MITRE S0367, 21 rules on this port), Zeus (15 rules), the Cobalt Strike framework (S0154), and the ZeroAccess botnet (S0027). Most rules that target HTTP-based attacks are written to fire on whichever port carries HTTP traffic, so a high rule count on 8080 reflects this overlap rather than 8080-specific threats.
What makes port 8080 distinct from port 80 is the kind of service typically running on it. Port 80 is usually a public-facing web server, whose security is the responsibility of a team that is paid to maintain it. Port 8080 is more often an application server that was supposed to be internal but ended up exposed, a development server that someone forgot to take down, or an admin interface on a device the owner does not realize is reachable from the internet. The classic 8080 incident is not a sophisticated attack against a hardened server; it is an attacker discovering a forgotten or misconfigured service on a port that is not where its owner expected to find it.
Common practice today is to bind application servers to localhost or to internal interfaces only, exposing them to the internet only through a hardened reverse proxy on standard ports. Development servers should never be reachable from the public internet. Embedded device admin interfaces should be restricted to local network ranges and ideally placed behind a VPN.
Inbound TCP/8080 to an internet-facing host that does not have an explicit reason to serve traffic on this port is worth investigating. The port itself is not dangerous, but seeing an unexpected service answering on it usually means something was misconfigured.
IDS Rule References
2046 IDS / security rules reference TCP port 8080. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): trojan-activity (729), web-application-activity (477), web-application-attack (344), attempted-recon (270), misc-activity (76), attempted-user (58).
Sample rule descriptions for TCP port 8080:
- SERVER-OTHER RealNetworks Server template.html
- SERVER-OTHER delegate proxy overflow
- SERVER-WEBAPP PCCS mysql database admin tool access
- SERVER-WEBAPP HyperSeek hsx.cgi directory traversal attempt
- SERVER-WEBAPP SWSoft ASPSeek Overflow attempt
Malware Activity
A meaningful share of monitored traffic on this port involves malware indicators.
682 of 2046 IDS rules for TCP port 8080 involve malware activity.
Families observed (top 8): Bancos (20), Fareit (15), Zeus (15), DesertFalcon (11), Symmi (11), Zebrocy (11), Chopper (10), Locky (9), and 263 more families.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).