Internet-Security raven logo internet-security.com

TCP 4444

ProtocolTCP
Port4444
LabelsI2P HTTP/S proxy

Synopsis

  • Selenium Server/Selenium Grid listens on TCP 4444 by default for WebDriver (/wd/hub) connections (e.g., http://localhost:4444).
  • The I2P router’s built-in HTTP proxy (eeproxy) defaults to localhost:4444 to tunnel web traffic through the I2P network.
  • Sophos UTM (Astaro) and Sophos XG Firewall use HTTPS on port 4444 for their WebAdmin interface (e.g., https://:4444).
  • The Metasploit Framework commonly uses port 4444 as the default LPORT for reverse shells/Meterpreter handlers; attackers also abuse this convention.
  • The W32.Blaster (MSBlast) worm opened a backdoor listening on TCP 4444 on infected Windows systems to accept commands.
  • Older JBoss Application Server (3.x/4.x) exposed a JBoss Remoting/JRMP invoker on TCP 4444 by default, which has been targeted in remote code execution attacks when left unsecured.

Observed activity

Last 30 days Detailed chart

More information