Squid's default proxy port, and the number scanners hunt for open HTTP proxies.
IANA registers 3128 as ndl-aas, Active API Server Port, but in practice 3128 is Squid: it is the default http_port in the shipped squid.conf, and other forward proxies and corporate web gateways copy it. A client sends absolute-URI GET requests or a CONNECT to tunnel TLS, and the proxy answers with normal HTTP status codes, including 403 when its ACLs deny you. It is one of the most heavily scanned ports on the internet because an unauthenticated proxy is immediately useful for relaying abuse and hiding source addresses.
Do not expose
An internet-facing proxy that accepts requests from anywhere will be found and used within hours; restrict it with Squid ACLs to your own networks and reach it over VPN.
$ curl -sS -x http://TARGET:3128 -o /dev/null -D - http://example.com/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.