A very common local development-server port — Phoenix and Jekyll both default to it — with a long tail of legacy and game traffic behind it.
IANA registers 4000 as terabase, which you will never meet. What actually binds 4000 today is development tooling: Elixir's Phoenix framework accepts requests on 4000 by default, and jekyll serve defaults to 4000 too. Historically the port carried the legacy Mirabilis ICQ client, Diablo II multiplayer, and the RemoteAnything remote-control product, which is why old scanner databases and firewall rulesets attach suspicious labels to it. On a modern host, 4000 is a developer's machine or a container running a dev build far more often than anything else.
Expose with care
A framework dev server here has debug pages, stack traces and live reload and must not face the internet; a real application behind a reverse proxy on 4000 is fine.
$ curl -sI http://localhost:4000/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.