Port 4444 (Metasploit default listener)
Not a standard service: the default listening port for Metasploit payloads such as Meterpreter.
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Traffic to or from 4444 is a classic sign of off-the-shelf exploitation tooling.
- Attackers often change it, so absence proves nothing.
When it shows up in your logs
A host connecting out to port 4444 should be treated as possibly compromised.