Registered to NDMP backup traffic, but on a Linux box it is nearly always Webmin's root-level web console.
IANA assigns 10000 to NDMP, the Network Data Management Protocol that backup software uses to drive NAS filers and tape libraries. The listener you far more often meet is Webmin: its installer writes listen=10000 into miniserv.conf and serves the administration UI over HTTPS there. Older macOS used 10000 for AirPort admin, which is why Nmap's database carries three names for it at once. At about 1.2% of scanned hosts open, it is one of the most commonly found ports above 9000.
Do not expose
Webmin is a root-equivalent web console with a history of pre-auth remote code execution (CVE-2019-15107 among others), and NDMP's base authentication is cleartext. Put either behind a VPN, not a public IP.
$ curl -skI https://TARGET:10000/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.