Port 50050 (Cobalt Strike team server)
Not a standard service: the default port for the Cobalt Strike team server, used by red teams and criminals.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Internet scans for 50050 are used to find Cobalt Strike infrastructure.
- Operators often change it, so absence proves nothing.
When it shows up in your logs
A server of yours listening on 50050 needs urgent investigation.