The default port for MySQL and MariaDB. Applications connect here to run queries, which in a well-arranged deployment means the application servers and nothing else — the database is not something end users talk to.
Among the most scanned ports on the internet. Bind to 127.0.0.1 unless you genuinely need remote access, and if you do, restrict it to specific addresses over a private network or tunnel.
MySQL open to the internet should be closed and then audited. Check for accounts allowed from any host and review recent connections, since exposed instances are found by scanning within hours.
The port scanner will tell you whether 3306 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.