Internet-Security.com TCP port 8728 details

TCP port 8728 is the default port for the MikroTik RouterOS API (unencrypted) on MikroTik routers and CHR instances (e.g., CCR, CRS, hAP series).
Automation tools use it, such as Ansible’s community.routeros collection and Terraform providers for RouterOS (e.g., ddelnano/terraform-provider-routeros), to manage configuration.
Common client libraries that connect on 8728 include Python’s routeros-api and librouteros, Go’s go-routeros, PHP’s mikrotik/api-php, and Java’s mtik4j.
Real-world monitoring/integration examples include Zabbix community templates that pull RouterOS data via the API and various backup/configuration scripts used by network operators.
A TLS-secured variant of the same API typically runs on port 8729.
Because it exposes device management, TCP/8728 is often scanned and targeted for brute-force or abuse when left open to the internet; several botnets have probed MikroTik API endpoints, and past MikroTik compromises have exploited weak credentials or outdated RouterOS (though the 2018 Winbox bug was on 8291).

TCP 8728