What is TCP port 8080 commonly used for, and why might a security team choose to block it on the perimeter?

• A.Port 8080 is used exclusively by malware; it should always be blocked
• B.TCP 8080 is a commonly used alternative HTTP port (HTTP alternate, HTTP proxy port); commonly used by: development web servers (Python HTTPServer, Node.js Express default), application servers (Tomcat, JBoss), web proxies (Squid, HTTP proxies). Security teams may block 8080 because: (1) some malware and C2 frameworks use 8080 to evade simple port-based firewalls that only allow 80/443; (2) unintentional internal web service exposure -- developers spin up test servers on 8080 and forget them; (3) policy: allow only standard web ports (80/443) through the perimeter
• C.TCP 8080 is the default port for RDP on non-Windows servers
• D.TCP 8080 is an encrypted variant of HTTP that provides TLS without certificate requirements