NetSecWallFree trialDownload
Port 4444 · TCP

Port 4444: No standard use; often seen in attacks

Port 4444 has no standard service. It is the default listener port of the Metasploit penetration-testing framework, and the Blaster worm opened a remote shell on it.

Protocol
TCP
On Windows
Not part of Windows; installed software uses it
Risk if open to the internet
High

Seeing it on your PC

Some legitimate software does use 4444, so the port alone proves nothing. A connection on 4444 between your PC and an internet address you do not recognise deserves a close look.

Should you block it?

Find the program first. If you cannot explain it, disconnect from the network and scan the PC.

Check it on your PC

Run this in PowerShell to see what is using port 4444 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 4444 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 4444" -Direction Inbound -Protocol TCP -LocalPort 4444 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.