# WHATPORT(4444)

## NAME

port 4444 — krb524 (IANA) / Metasploit handler / I2P HTTP proxy / Galera SST — The internet's favourite memorable port — Metasploit shells, I2P's local proxy, and Galera state transfers all land here.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA's registration is krb524, the long-obsolete Kerberos 5-to-4 ticket translator. What matters now is convention. Metasploit payload handlers default to LPORT 4444, which made the number a signature for reverse shells and for the 2003 Blaster worm's backdoor. I2P routers run their HTTP proxy on 127.0.0.1:4444. MariaDB and Percona Galera clusters receive state snapshot transfers (SST) on 4444 by default, next to 4567 for replication. Identity depends entirely on the host: a database cluster member, an anonymity router, or something you did not install.

## EXPOSURE

**Do not expose.** None of the real users of 4444 want public exposure — the I2P proxy is localhost-only, Galera SST is intra-cluster, and an unexplained listener on 4444 on an internet-facing host should be treated as an incident, not a configuration question.

## CHECK

```sh
nc -vz -w 3 TARGET 4444
```

## SEE ALSO

- docs — [I2P FAQ — port 4444 is the router's HTTP proxy](https://i2p.net/en/docs/overview/faq) (i2p.net)
- docs — [MariaDB — Galera cluster address and ports (SST on 4444)](https://mariadb.com/docs/galera-cluster/galera-management/configuration/galera-cluster-address) (mariadb.com)
- source — [rapid7/metasploit-framework](https://github.com/rapid7/metasploit-framework) (github.com)
- iana — [IANA port registry — 4444 (krb524)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4444) (iana.org)

---

HTML: <https://whatport.net/4444/> · JSON: <https://whatport.net/4444.json> · full dataset: <https://whatport.net/ports.json>