The internet's favourite memorable port — Metasploit shells, I2P's local proxy, and Galera state transfers all land here.
IANA's registration is krb524, the long-obsolete Kerberos 5-to-4 ticket translator. What matters now is convention. Metasploit payload handlers default to LPORT 4444, which made the number a signature for reverse shells and for the 2003 Blaster worm's backdoor. I2P routers run their HTTP proxy on 127.0.0.1:4444. MariaDB and Percona Galera clusters receive state snapshot transfers (SST) on 4444 by default, next to 4567 for replication. Identity depends entirely on the host: a database cluster member, an anonymity router, or something you did not install.
Do not expose
None of the real users of 4444 want public exposure — the I2P proxy is localhost-only, Galera SST is intra-cluster, and an unexplained listener on 4444 on an internet-facing host should be treated as an incident, not a configuration question.
$ nc -vz -w 3 TARGET 4444Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.