Port 5280XMPP BOSH

HTTP long-polling transport for carrying XMPP sessions between clients and an XMPP server.

transport: tcp
in transit: cleartext
assignment: official
risk: 5/10
lookups: 0

also known as XMPP over HTTP, XEP-0124

Technical Details

what runs on :5280

BOSH (Bidirectional-streams Over Synchronous HTTP), specified by XEP-0124, carries XMPP stanzas inside HTTP POST requests and XML <body> wrappers. A client establishes a session, then uses request identifiers and long-polling parameters such as wait and hold to simulate bidirectional communication; sessions are terminated with a final request. Port 5280 normally provides HTTP and is therefore cleartext; deployments commonly use HTTPS through a reverse proxy or a separate TLS listener, frequently on 443 or 5281.

Security Information

exposure of :5280

risk score

5/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

web services averages 3.4 across 147 ports — this one sits 1.6 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

An exposed BOSH endpoint can be used to authenticate XMPP accounts, exchange messages, and consume server resources through many long-lived HTTP requests. Plain HTTP can reveal credentials and message content, so internet-facing deployments should require HTTPS, enforce XMPP authentication and origin controls, and apply connection, request, and abuse-rate limits.

Record

iana registry entry

port: :5280
service: XMPP BOSH
transport: TCP
encryption: cleartext
assignment: iana registered
risk: 5/10caution
category: Web Services Voice and Chat
usage: TCP 5280 commonly serves BOSH, allowing browser-based XMPP clients and other restricted clients to communicate through HTTP long-polling. XMPP servers such as ejabberd, Prosody, and Openfire may expose this endpoint, often behind a reverse proxy.
lookups: 0rank 994
added: 2026-09-08
updated: 2026-09-08
references: IANA service name registry — port 5280

Something wrong?

This record is maintained by the engineers who use port 5280. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-09-08.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 147 in web services →

the 8 most looked-up other ports in web services — 147 ports carry that label.

port	service	proto	category	risk	views
:8888	Sun Answerbook & Alt HTTP	TCP	Web Services	caution	123.9k
:8000	Intel Remote Desktop / Alternate HTTP Port	TCP	Web Services	safe	84.3k
:8888	NewsEDGE	TCPUDP	Web Services	caution	83.3k
:8888	HTTP Alternative Port	TCP	Web Services	caution	76.5k
:8888	GNUmp3d Streaming HTTP	TCP	Web Services	caution	76.3k
:9080	Groove RPC	TCPUDP	Web Services	caution	70.8k
:8881	Atlasz Secure Server	TCP	Web Services	caution	67.6k
:80	HTTP	TCPUDP	Web Services	caution	67.3k

risk mix of the 8 listed

safe13%
caution88%

0 of 8 encrypted

Port :5280XMPP BOSH

Technical Details

Security Information

Related Ports

Port 5280XMPP BOSH