<p>As @Anonymous said Electrum servers listen on port 50002 so that's what you are seeing here. Your phone is connecting from a random local port to remote 50002 on the servers. </p>

<p>Electrum gets blockchain data from electrum servers run by volunteers. These servers see your addresses + transactions but they don't see your private keys or seed. So you lose privacy compared to using a full node like bitcoin core but you still have exclusive control of the secrets that let you spend your bitcoins. The upside of using electrum over a full node is that you don't have to download the 200GB blockchain. You can get up and running straight away.</p>

CC BY-SA 4.0
2018-10-27T09:17:31.850Z
2018-10-27T09:17:31.850Z
Abdussamad
<p>A few days ago, I was exploring Electrum (Android) out of curiosity. A few moments later, I get notified by our firewall that it flagged several suspicious inbound requests. The source IPs came from various countries, all of which use port 50002. The destination was my phone, at seemingly random ports. I disconnected my phone from the internet, and the requests would stop. They'd start again if I connected and used Electrum.</p>

<p>Initially, I thought Electrum was P2P and was doing peer discovery, which would conveniently explain why a machine over the internet would attempt to talk to my machine. But reading <a href="https://electrumx.readthedocs.io/en/latest/" rel="nofollow noreferrer">ElectrumX</a>'s docs and several other online resources, Electrum is a client-server setup - wallets talk to servers. The only P2P component I see is when servers talk to other servers to find other servers or advertise their presence to other servers. But this would not explain the inbound connection to my machine.</p>

<p>So what's going on? Is this normal behavior? Is the wallet also a "peer"? Or is this some malicious attempt to break in? Everyone coming from port 50002 and Electrum servers using port 50002 is probably not coincidence though. Thoughts? Did I miss some detail in the docs?</p>

CC BY-SA 4.0
2018-10-27T03:56:55.650Z
Were the inbound requests trying to connect to port 50002 or were they specifically trying to connect to some open port on your phone? Are you sure that it wasn't the Electrum servers responding to the Electrum app connecting to them?
Ava Chow
CC BY-SA 4.0
2018-10-27T06:57:13.020Z
I think you’re misreading, those are outbound connections.
Claris
<wallet><electrum><wallet-security><peer-discovery>
Inbound requests after opening Electrum
Joseph
# Inbound requests after opening Electrum

(Asked by: username_0 on 2018-10-27)

A few days ago, I was exploring Electrum (Android) out of curiosity. A few moments later, I get notified by our firewall that it flagged several suspicious inbound requests. The source IPs came from various countries, all of which use port 50002. The destination was my phone, at seemingly random ports. I disconnected my phone from the internet, and the requests would stop. They'd start again if I connected and used Electrum.

Initially, I thought Electrum was P2P and was doing peer discovery, which would conveniently explain why a machine over the internet would attempt to talk to my machine. But reading [ElectrumX](https://electrumx.readthedocs.io/en/latest/)'s docs and several other online resources, Electrum is a client-server setup - wallets talk to servers. The only P2P component I see is when servers talk to other servers to find other servers or advertise their presence to other servers. But this would not explain the inbound connection to my machine.

So what's going on? Is this normal behavior? Is the wallet also a "peer"? Or is this some malicious attempt to break in? Everyone coming from port 50002 and Electrum servers using port 50002 is probably not coincidence though. Thoughts? Did I miss some detail in the docs?

**Tags:** wallet, electrum, wallet-security, peer-discovery

> **Comments:**
> **username_1**: Were the inbound requests trying to connect to port 50002 or were they specifically trying to connect to some open port on your phone? Are you sure that it wasn't the Electrum servers responding to the Electrum app connecting to them?  
> **username_2**: I think you’re misreading, those are outbound connections.  

---

## 1 answers

### Answer by username_3 on 2018-10-27. Score: 2 | Accepted answer

As @Anonymous said Electrum servers listen on port 50002 so that's what you are seeing here. Your phone is connecting from a random local port to remote 50002 on the servers.

Electrum gets blockchain data from electrum servers run by volunteers. These servers see your addresses + transactions but they don't see your private keys or seed. So you lose privacy compared to using a full node like bitcoin core but you still have exclusive control of the secrets that let you spend your bitcoins. The upside of using electrum over a full node is that you don't have to download the 200GB blockchain. You can get up and running straight away.


---

