Shodan showed me that my port 3128 was open and a Web proxy (with authentication required) was running on it. I can confirm it with telnet.
On the Turris itself, lsof shows nothing listening on port 3128.
I have activated honeypots for ssh and telnet but what about port 3128? Another (undocumented,) honeypot?