{
  "port": 4125,
  "protocol": "tcp",
  "service": "Microsoft Remote Web Workplace (TS Proxy) / Opsview Envoy",
  "oneLiner": "The RDP proxy of Small Business Server 2003's Remote Web Workplace — a relay into desktops on the LAN.",
  "whatItIs": "In SBS 2003, Remote Web Workplace let remote staff reach internal desktops through a browser, and its TS Proxy component listened on TCP 4125: the client's ActiveX control connected there and the server relayed the session onward to port 3389 on the chosen workstation. SBS 2008 moved that traffic to 443, and SBS itself has been end-of-life for years. IANA registers the port to a different service entirely, Opsview Envoy. An open 4125 today is nearly always an abandoned SBS 2003 box still publishing a route to internal RDP.",
  "exposure": {
    "verdict": "never",
    "note": "It is an internet-facing relay into LAN RDP sessions, running on a Windows version that stopped receiving security updates in 2015."
  },
  "checkCommand": "nc -vz -w 3 TARGET 4125",
  "links": [
    {
      "title": "Microsoft — Inside the Remote Web Workplace, Part I (TS Proxy on TCP 4125)",
      "url": "https://learn.microsoft.com/en-us/archive/blogs/sbs/inside-the-remote-web-workplace-part-i",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 4125 (opsview-envoy)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4125",
      "kind": "iana"
    }
  ]
}