3128
Summary
- // if you see it open
- A misconfigured or unauthenticated Squid instance acts as an open relay, enabling DDoS amplification, botnet C2 anonymization, and spam. Squid's Cache Manager endpoint on the same port can disclose server internals useful for lateral movement. Squid carries a long CVE tail; recent high-severity issues include CVE-2025-62168 (HTTP auth credentials in error messages) and CVE-2025-54574 (heap buffer overflow in URN processing, potential RCE). Older notable CVEs: CVE-2019-12526, CVE-2019-12525 (DoS), CVE-2016-10002 (HTTP response splitting). The IANA 'ndl-aas' assignment is obsolete/unused — Squid's claim to 3128 is convention, not IANA designation.
- // common applications
- Squid
- // analyst note
- an exposed 3128 is most often a proxy (intended or accidental open relay); treat unauthenticated instances as abuse-prone and block at the perimeter unless deliberately operated.
About port 3128/tcp.
Port 3128/tcp carries an interesting split between what IANA records and what the port actually means on the live internet. In the IANA Service Name and Transport Protocol Port Number Registry, 3128 is registered as ndl-aas — "Active API Server Port" — assigned to Martin Norman, dual-registered on both TCP and UDP with a blank reference field (no RFC). That assignment is essentially invisible in practice: virtually no one runs "ndl-aas" on this port. What 3128 is known for, instead, is being the default listening port of Squid, the most widely deployed open-source HTTP/HTTPS caching and forwarding proxy. A client sends an HTTP CONNECT or GET to 3128, Squid fetches the resource from origin, optionally caches it, and returns the response. The same de-facto port is the default for a long tail of other proxy software — ccProxy, WinGate, Privoxy, AnalogX, FreeProxy, HandyCache. For an analyst, the security posture matters more than the registry line. Port 3128 is one of the most heavily scanned ports on the internet: open-proxy enumeration scripts probe it routinely, and GreyNoise files much of the traffic under "Open Proxy Scanner" / "SOCKS5 Proxy Scanner" tags. A misconfigured or unauthenticated Squid acts as an open relay — useful to attackers for DDoS amplification, botnet C2 anonymization, and spam — and Squid's Cache Manager endpoint on the same port can leak internals. Squid has carried a long CVE tail, including recent high-severity issues. Best practice is to block inbound 3128 at the perimeter unless the host is an intentional, ACL-authenticated proxy, and to patch Squid promptly.
- IANA assignment
ndl-aas— "Active API Server Port"; reference (blank — no RFC cited in IANA registry); assignee Martin Norman; dual-registered 3128/tcp + 3128/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry lines 6208-6209)- Range class
- registered (1024–49151)
- IANA-vs-reality note
- the
ndl-aasIANA assignment is obsolete/unused in practice; Squid's claim to 3128 is convention, not IANA designation [Confirmed] — connected.app/ports/3128, scanitex.com - Prevalence/exposure
- heavily scanned; Shodan reportedly shows ~1.1 million hosts listening on 3128 (exact snapshot date unpublished) [Likely] — Shodan via scanitex.com summary
Primary use (de facto)
default listening port for the Squid HTTP/HTTPS caching/forwarding proxy; client sends CONNECT/GET, Squid fetches from origin and optionally caches
Other/unofficial uses
default or common proxy port for ccProxy, WinGate, Privoxy, AnalogX, FreeProxy, HandyCache, Internet Accelerator
Security implications
open/unauthenticated Squid = open relay (DDoS amplification, C2 anonymization, spam); Cache Manager endpoint can disclose server internals; standard open-proxy-scanner target
Notable CVEs
CVE-2025-62168 (HTTP auth credentials disclosed in error messages) and CVE-2025-54574 (heap buffer overflow in URN processing, potential RCE) — high-severity, CVSS per third-party trackers pending direct NVD confirmation [Likely]; older: CVE-2019-12526, CVE-2019-12525 (DoS), CVE-2016-10002 (HTTP response splitting)
Malware associations
historically linked to the RingZero trojan and Mydoom variants using 3128 as a C2/relay channel
- Analyst note
- an exposed 3128 is most often a proxy (intended or accidental open relay); treat unauthenticated instances as abuse-prone and block at the perimeter unless deliberately operated.
About port 3128/udp.
Port 3128/udp is registered with IANA as ndl-aas with the description "Active API Server Port," assignee and contact Martin Norman of NDL (Norman Data Link), and a blank reference field; it is dual-registered on both TCP and UDP, with the identical ndl-aas entry sitting at 3128/tcp. The registry carries no registration date, no modification date, and no RFC or assignment-note reference for this entry — all of those columns are blank in the IANA service-names CSV and stay null here. In practice, port 3128 is overwhelmingly associated with the Squid caching HTTP proxy, but that association is a TCP phenomenon: Squid listens on TCP 3128 for client HTTP-proxy connections, while its UDP inter-cache communication (ICP, the Internet Cache Protocol) defaults to port 3130/udp, not 3128. Some third-party port databases label 3128/udp as "Squid-UDP," but that label is misleading — there is no documented, widely-deployed real-world UDP service running on 3128 in any major software, and the IANA registrant (NDL's "Active API Server Port") is unrelated to Squid. For an analyst this matters because the security weight of port 3128 sits almost entirely on TCP: open/misconfigured Squid proxies that allow unauthenticated relay are an active daily scanning target (SANS ISC tracks scanning aimed at finding badly configured proxies usable for anonymization, firewall bypass, or attack relay), and the port carries historical malware associations on TCP (the MyDoom worm backdoor and the RingZero trojan). No exploit, threat, or meaningful service traffic specific to 3128/udp has been documented in publicly available sources as of June 2026, so a responsive 3128/udp listener is unusual and should be investigated rather than assumed to be Squid.
- IANA assignment
ndl-aas— "Active API Server Port"; reference (blank — no RFC cited in IANA registry); assignee/contact Martin Norman of NDL; dual-registered 3128/tcp + 3128/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (cached CSV line 6209; web search https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3128)- Range class
- registered (1024–49151)
- Registration date
- Unknown (blank in IANA registry) — not fabricated [Confirmed] — IANA CSV (date column blank)
- Modification date
- Unknown (blank in IANA registry) [Confirmed] — IANA CSV (date column blank)
- Related ports
- 3130/udp (Squid ICP inter-cache); 8080/tcp and 3128/tcp (common HTTP-proxy ports)
Primary use
IANA-registered to NDL (Norman Data Link) as an "Active API Server Port"; no widely-deployed software is known to use 3128/udp in practice
Other/unofficial uses
some third-party databases mislabel 3128/udp as "Squid-UDP," but Squid's actual UDP inter-cache protocol (ICP) defaults to 3130/udp, not 3128
Security implications (port 3128 overall, TCP-concentrated)
open/misconfigured Squid HTTP proxies are an active daily scanning target (anonymization, firewall bypass, attack relay); historical malware on TCP 3128 includes the MyDoom worm backdoor and the RingZero trojan
Security implications (3128/udp specifically)
Unknown — no documented exploit or active threat specifically targeting 3128/udp identified in public sources as of June 2026; SANS ISC scanning telemetry aggregates TCP and UDP for this port
Typically seen on
TCP 3128 — Squid proxy deployments; 3128/udp — no known real-world service traffic (an anomaly worth investigating)
- Analyst note
- Do not assume a 3128 listener is Squid-over-UDP — Squid's UDP is 3130. A responsive 3128/udp host has no documented legitimate service and warrants investigation.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| squid-http | TCP | ndl-aas | 0.45% |
| ndl-aas | UDP | Active API Server Port | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.