{
  "port": 3128,
  "protocol": "tcp",
  "service": "Squid / HTTP proxy",
  "oneLiner": "Squid's default proxy port, and the number scanners hunt for open HTTP proxies.",
  "whatItIs": "IANA registers 3128 as `ndl-aas`, Active API Server Port, but in practice 3128 is Squid: it is the default `http_port` in the shipped squid.conf, and other forward proxies and corporate web gateways copy it. A client sends absolute-URI GET requests or a CONNECT to tunnel TLS, and the proxy answers with normal HTTP status codes, including 403 when its ACLs deny you. It is one of the most heavily scanned ports on the internet because an unauthenticated proxy is immediately useful for relaying abuse and hiding source addresses.",
  "exposure": {
    "verdict": "never",
    "note": "An internet-facing proxy that accepts requests from anywhere will be found and used within hours; restrict it with Squid ACLs to your own networks and reach it over VPN."
  },
  "checkCommand": "curl -sS -x http://TARGET:3128 -o /dev/null -D - http://example.com/",
  "links": [
    {
      "title": "Squid documentation — http_port directive",
      "url": "https://www.squid-cache.org/Doc/config/http_port/",
      "kind": "official-docs"
    },
    {
      "title": "Squid source repository",
      "url": "https://github.com/squid-cache/squid",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}