TCP Port 443 – HTTPS (HTTP over TLS)
Port 443 is the standard port for HTTPS, the encrypted version of the Hypertext Transfer Protocol. When a browser visits a site whose URL begins with https://, it connects to TCP port 443 on the server and negotiates a TLS (Transport Layer Security) encrypted session before sending or receiving any web content. Once that session is established, the browser and server exchange ordinary HTTP requests and responses inside the encrypted tunnel, hidden from anyone observing the network in between.
Almost all modern web traffic uses port 443. After Google, Mozilla, and other major platforms began nudging the web toward HTTPS-by-default in the mid-2010s, and after services like Let’s Encrypt made certificates free and automated, unencrypted HTTP on port 80 declined sharply. Today, every consumer device, every web server, and the great majority of public APIs use TLS on port 443. Outbound TCP/443 from a typical computer or phone is not just normal, it is nearly constant.
Newer versions of HTTP have shifted some of this traffic onto UDP. HTTP/3 runs over the QUIC transport protocol, which uses UDP rather than TCP. QUIC sessions still use port 443, which is why the IANA registry now lists HTTPS on UDP/443 alongside the original TCP assignment. Browsers from major vendors negotiate HTTP/3 automatically when the server supports it, so the same web request can travel over TCP/443 or UDP/443 depending on the protocol version available. SCTP/443 is also defined in the registry but sees little real-world use.
Inbound TCP/443 to a host that is not a designated web server, API endpoint, or other public-facing service is uncommon and worth investigating. Outbound TCP/443 from end-user devices is essentially universal and not unusual on its own.
About TCP Port 443
Port 443 carries the IANA assignment for https. The IANA description reads: ‘http protocol over TLS/SSL’.
Security Considerations
The security story for port 443 is different from most ports on this list. Direct attacks against well-maintained HTTPS servers are relatively rare in modern data, and our rule activity reflects this: only 4 of the 164 IDS rules referencing port 443 fall into the attempted-admin category. The dominant pattern is something else entirely. 74 of the rules are classified as trojan-activity and 37 as command-and-control. The threat is not compromise of the HTTPS service. It is malware on already-compromised hosts using port 443 as the channel to phone home.
Encrypted, ubiquitous, and almost always allowed outbound through corporate firewalls, port 443 is ideal cover for command-and-control traffic. Modern banking trojans, ransomware loaders, and espionage frameworks routinely tunnel their command channels inside TLS sessions on this port, where they blend into the constant stream of legitimate web traffic. Our dataset names many such families, including Emotet (MITRE S0367), Trickbot (S0266), Dyre (S0024), and CozyDuke (S0046, associated with the APT29 espionage group). Several historical server-side attacks also appear in the rules, including traffic patterns from the 2002 OpenSSL Slapper worm and SSLv2 Client_Hello overflow attempts targeting older Apache mod_ssl deployments.
Defensive practice has shifted accordingly. Network monitoring increasingly relies on metadata about TLS sessions (server name indication, certificate properties, fingerprinting techniques like JA3 and JA4) and on DNS-level blocklists of known command-and-control domains, since the payload itself cannot be read without intercepting the TLS handshake. Organizations that perform TLS interception at the perimeter trade some user privacy for visibility into encrypted traffic. Endpoint detection products complement network monitoring by inspecting traffic on the sending host before it is encrypted.
Inbound TCP/443 traffic to a workstation that is not a web server, or sustained outbound TCP/443 connections to unfamiliar domains from an end-user device, are worth investigating as potential indicators of malware command-and-control behavior. Volume and pattern matter more than the port itself; constant TLS connections to a single unknown destination from a host that should not be making them is a stronger signal than the presence of TLS traffic in general.
IDS Rule References
115 IDS / security rules reference TCP port 443. Presence in IDS rules does not mean traffic on this port is malicious. These are patterns security tools monitor.
Rule categories (top 6): trojan-activity (60), attempted-recon (27), command-and-control (15), bad-unknown (5), targeted-activity (3), attempted-admin (2).
Sample rule descriptions for TCP port 443:
- SERVER-OTHER OpenSSL Worm traffic
- SERVER-WEBAPP SSLv2 Client_Hello Challenge Length overflow attempt
- SERVER-WEBAPP SSLv2 Client_Hello with pad Challenge Length overflow attempt
- MALWARE-CNC Win.Trojan.Hydraq variant outbound connection
- MALWARE-CNC Win.Trojan.Symmi variant outbound connection
Malware Activity
Malware activity is frequently observed on this port.
79 of 115 IDS rules for TCP port 443 involve malware activity.
Families observed (top 8): RisePro (5), MooBot (4), Trickbot (4), Win32_HMR (4), Gh0st (3), PCRAT (3), TA430 (3), Kazy.53640 (2), and 42 more families.
Data Sources
This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry, Emerging Threats Open Ruleset (BSD 2-Clause / GPLv2 per SID range), Snort Community Rules (GPLv2), and MITRE ATT&CK (Apache 2.0).