{
  "port": 4444,
  "protocol": "tcp",
  "service": "krb524 (IANA) / Metasploit handler / I2P HTTP proxy / Galera SST",
  "oneLiner": "The internet's favourite memorable port — Metasploit shells, I2P's local proxy, and Galera state transfers all land here.",
  "whatItIs": "IANA's registration is krb524, the long-obsolete Kerberos 5-to-4 ticket translator. What matters now is convention. Metasploit payload handlers default to LPORT 4444, which made the number a signature for reverse shells and for the 2003 Blaster worm's backdoor. I2P routers run their HTTP proxy on 127.0.0.1:4444. MariaDB and Percona Galera clusters receive state snapshot transfers (SST) on 4444 by default, next to 4567 for replication. Identity depends entirely on the host: a database cluster member, an anonymity router, or something you did not install.",
  "exposure": {
    "verdict": "never",
    "note": "None of the real users of 4444 want public exposure — the I2P proxy is localhost-only, Galera SST is intra-cluster, and an unexplained listener on 4444 on an internet-facing host should be treated as an incident, not a configuration question."
  },
  "checkCommand": "nc -vz -w 3 TARGET 4444",
  "links": [
    {
      "title": "I2P FAQ — port 4444 is the router's HTTP proxy",
      "url": "https://i2p.net/en/docs/overview/faq",
      "kind": "official-docs"
    },
    {
      "title": "MariaDB — Galera cluster address and ports (SST on 4444)",
      "url": "https://mariadb.com/docs/galera-cluster/galera-management/configuration/galera-cluster-address",
      "kind": "official-docs"
    },
    {
      "title": "rapid7/metasploit-framework",
      "url": "https://github.com/rapid7/metasploit-framework",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 4444 (krb524)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4444",
      "kind": "iana"
    }
  ]
}