A heavily overloaded port: PHP-FPM's FastCGI socket, ClickHouse's native protocol, and several self-hosted consoles.
IANA registers 9000 as cslistener, but you will meet it as PHP-FPM listening for FastCGI (listen = 127.0.0.1:9000) or as ClickHouse's native client/server protocol. Several self-hosted tools also default here, so identify the service before assuming. PHP-FPM is the dangerous case: the protocol is FastCGI, not HTTP, so a browser gets nothing while an attacker gets code execution.
Do not expose
PHP's own manual states an exposed FastCGI endpoint allows arbitrary code execution, and listen.allowed_clients is unset by default.
$ sudo lsof -nP -iTCP:9000 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.