whatportis.com
suggest an edit →

Port 9050Tor SOCKS Proxy

Port 9050 is primarily used by the Tor network as a SOCKS proxy, allowing applications to anonymize their internet traffic by routing it through the Tor network. This process provides privacy and obfuscation of the user's IP address, enabling access to content anonymously across the internet, including hidden services on the dark web. While widely adopted for privacy-focused browsing, its use must be carefully managed due to security considerations..

inSecurityNetwork Services
transport
tcp

single transport

in transit
cleartext

payload readable on path

assignment
unofficial

used by convention

risk
5/10

caution

lookups
7,850

rank 649 of 993 · top 65%

Technical Details

what runs on :9050

Port 9050 is most commonly associated with the Tor network, acting as a local SOCKS proxy through which client applications can tunnel their internet traffic. When a Tor client is running, it listens on this port to accept connections from browsers and other tools configured to route traffic anonymously. This configuration ensures that outgoing requests are encrypted and relayed across multiple volunteer-operated Tor nodes, making it difficult for observers to trace the original source.

The communication on port 9050 typically follows the SOCKS5 protocol, which supports authentication, UDP relays, and IPv6. Applications configure their network requests to point to the local machine on this port, effectively handing off all internet-bound data to the Tor daemon. This setup abstracts away the complexities of Tor routing from the application, centralizing anonymity controls.

Port 9050 is an unofficial but de facto standard within the Tor community for SOCKS proxy services. It is distinct from other Tor control ports (such as 9051 for the Tor control interface) and focuses solely on data transport. Typical clients include Tor Browser, privacy-focused command-line applications, or system-wide proxy settings to anonymize multiple applications' traffic simultaneously.

Security Information

exposure of :9050

risk score

5/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.8 across 216 ports — this one sits 1.2 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

unofficial

used by convention, not registered — what answers here varies by deployment

reachable over

tcp

every listening transport is another surface to filter at the edge

security overview

Common vulnerabilities:

  • Malware and botnet command traffic: Threat actors often abuse Tor to hide command and control operations, which may operate through port 9050 proxies.
  • Traffic leaks: Misconfigured clients may leak real IP addresses if DNS or other requests bypass the proxy.
  • Exit node eavesdropping: While the SOCKS proxy itself is secure, traffic exiting the Tor network can be intercepted if not encrypted end-to-end.
  • Proxy abuse: Open or exposed Tor proxies may be misused by unauthorized parties, leading to unintentional facilitation of illicit activities.

Common mitigations:

  • Restrict access: Limit exposure by binding the Tor daemon to localhost only, forbidding remote proxy connections.
  • Use end-to-end encryption: Pair Tor with HTTPS or encrypted protocols to protect data beyond the exit node.
  • Network monitoring: Implement egress filtering and anomaly detection to identify suspicious Tor-related activity.
  • Client hardening: Configure applications to ensure all connections use the SOCKS proxy to prevent leaks (e.g., disabling DNS prefetching, or using tools like torsocks).
  • Policy controls: Organizations may need policies to manage or restrict Tor usage due to associated risks.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:3268Microsoft Global Catalog (GC)caution
:135Microsoft EPMAPcaution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution

risk mix of the 8 listed

  • caution100%

3 of 8 encrypted