Port Scanner

Scan your IP for open proxy ports and detect running proxy services

HOW IT WORKS

Port scanning process

IP DETECTION

Detect your public IP

PORT SCAN

Scan common proxy ports

PROTOCOL CHECK

Detect SOCKS4/5/HTTP

REPORT

Generate scan report

Open Ports on Your Home IP Shouldn't Exist. Here's Why They Do.

Run a port scan against your own home IP. In 2026, the expected result is nothing. Every port returns RST or silence. Scanner says zero open. Anticlimactic. That's the normal state of a residential connection behind NAT, and it's been the default for twenty years. If the scan finds SOCKS5 listening on 1080, or HTTP proxy on 3128, the diagnostic tree is short. Either you put it there (Tor relay, Squid cache, your own VPN exit) or you didn't (forgotten port forwarding from 2019, UPnP auto-opening ports behind your back, malware that enrolled your machine as a residential proxy node, IPv6 punching through a firewall that only guards IPv4). First case is fine. Second case is like discovering an unlocked window on the second floor: not catastrophic, but somebody should figure out why it's open and what's been climbing through.

What the Eleven Ports Actually Mean

Most proxy-detection scanners check the same eleven ports. The list isn't arbitrary. It comes from years of empirical data on where proxies actually listen. Port 1080: SOCKS. The original, still dominant. RFC 1928 defined SOCKS5 in 1996. Nearly every proxy daemon defaults to 1080. Tor deliberately avoids it, using 9050 and 9150 instead, specifically to dodge false positives. Port 3128: Squid. The open-source HTTP caching proxy that half the internet's ISPs deployed in the 2000s. Still ships with 3128 as default listener. Finding it on a residential IP means someone installed Squid on purpose, or the router shipped with bundled proxy software (certain Asus and Linksys models, usually disabled by default but not always). 8080 is the wild card. Generic HTTP proxy territory, also the go-to alternate port for web services that couldn't bind 80. Open 8080 by itself could be a proxy, an admin panel, a misconfigured Express.js app someone forgot was running. Ambiguous without a handshake probe. 8443: HTTPS alternate. Web admin interfaces, occasionally HTTPS-tunneling proxies. 4145, 6588, 8888: legacy and alternative SOCKS. AnalogX binds 8888. Tinyproxy uses 8888. Older SOCKS deployments land on 4145. 9050: Tor's default SOCKS5 listener. Open externally means Tor bound to 0.0.0.0 instead of localhost. Unusual config, worth investigating. 9051 is the Tor control port. Should never face the internet. If a scanner finds it open, someone can remotely reconfigure or shut down the relay. 9150: Tor Browser's SOCKS port, same story as 9050. The set covers about 90% of intentional proxy deployments. Custom ports on 12345 or 31337 exist but a full 65,535 sweep takes ten-plus seconds and rarely catches what the standard set misses.

Why Home Connections Normally Show Nothing

Default state of an internet-connected home: closed. Everything closed. Two mechanisms handle it. NAT does the heavy lifting. Router owns the WAN IP. Devices behind it get private addresses, 192.168.x.x or 10.x.x.x. Inbound traffic from the internet hits the router and stops there. Router has no idea which internal device should receive it unless you explicitly told it (port forwarding rules) or a device asked (UPnP). Default config on most post-2017 routers: no forwarding, UPnP off or restricted. Works like a hotel switchboard. Outside call only rings a room if the desk put that room on the connect list. Stateful firewall finishes the job. Router tracks outbound connections. Inbound packets that don't match an established session get dropped or RST'd. Even if a laptop behind NAT ran SOCKS5 on 1080, the router would never route an unsolicited SYN to it. The connection table has no entry. Packet goes nowhere. Two exceptions: router management interfaces (some expose admin on 80, 443, or 8080 to WAN, bad idea, enterprises sometimes need it, consumers never do) and ISP-mandated services (TR-069 on port 7547 for remote provisioning, scoped to the ISP's own address range). Outside those, everything a residential scanner touches should come back filtered or closed. Anything else? Something changed that probably shouldn't have.

Five Reasons a Port Is Open When It Shouldn't Be

Almost every unexpected open port traces back to one of five causes. Forgotten port forwarding. The most common by far. Years ago someone set up forwarding for a game server, BitTorrent, a security camera, remote desktop. The rule survived router reboots, firmware updates, even ownership changes. Original purpose is gone. Port stays open. Like a spare key the previous tenant cut and never returned: lock still accepts it, nobody remembers a copy exists. UPnP auto-opens. Universal Plug and Play lets devices request forwarding from the router automatically. Enabled by default on too many consumer routers. Gaming consoles use it. BitTorrent clients use it. Video conferencing tools use it. Malware uses it. The router opens whatever gets requested. Devices don't always close the port when they're done. Turns out UPnP is a yes-machine by design, and nobody built a good "are you sure?" into the protocol. Compromised devices. Malware-infected laptop or IoT gadget requests UPnP forwarding for its own purposes. Mirai-family botnets (telnet on 23, HTTP on 80 for C2). Residential proxy malware (1080, 4145, 8888). Cryptominer command channels. User has no clue the request happened. Router complied because that's what UPnP does. Intentional proxy enrollment. Apps like IPRoyal Pawns, EarnApp, HoneyGain pay pennies per gigabyte to turn your connection into a proxy exit. The software opens ports. Traffic from strangers flows through your IP. From the ISP and law enforcement perspective, that traffic is yours. The fine print covers this. Most users don't read fine print. IPv6 direct exposure. No NAT in IPv6. Every device gets a globally routable address. If the router's IPv6 firewall is misconfigured or someone toggled DMZ mode, devices are scannable from anywhere on Earth. This attack surface grows every quarter as IPv6 deployment climbs. Mitigation in order: audit what you intentionally exposed, disable UPnP unless something specific demands it, check router config for orphaned forwarding rules, run anti-malware on every networked device, verify the IPv6 firewall defaults to deny-inbound. Open proxy ports on a residential connection aren't a casual finding. Each one is a path for arbitrary external traffic to reach a device inside your network, wearing your IP address as a return label.

FREQUENTLY ASKED QUESTIONS

Why are ports open on my IP?

Open ports could mean you're running a proxy server, your router has port forwarding enabled, or malware has opened ports. If you didn't intentionally open these ports, investigate immediately.

What is SOCKS vs HTTP proxy?

SOCKS proxies work at a lower network level and can handle any type of traffic. HTTP proxies only handle HTTP/HTTPS traffic. SOCKS5 also supports authentication and UDP.

Is having open ports dangerous?

Open proxy ports can be exploited by attackers to use your connection for malicious activities. This could result in your IP being blacklisted or legal issues. Close any ports you don't need.

All our tests

Run the full WHOX toolkit from one place: leak checks, fingerprint probes, network diagnostics, reputation lookups, and privacy failure tests.