Port 5228: Google push (FCM)
Port 5228 is used by Android phones to keep a connection open to Google for push notifications.
What runs on port 5228
Google Play services holds a long-lived connection from Android devices to Google's servers on TCP 5228 (with 5229 and 5230 as fallbacks) so apps can receive notifications through Firebase Cloud Messaging. It is outgoing traffic from the phone.
On a home network
Android phones, tablets, Android TV and Chromebooks connect out to Google on 5228. Nothing on your network listens on it.
If port 5228 is reachable from the internet
There is nothing to expose: no home device should be listening on 5228, and outgoing connections to it are normal. If Android notifications arrive late on a particular Wi-Fi network, a firewall blocking outgoing 5228 is a common cause.
How to check whether it is open on your network
If a scan finds a device listening on 5228, investigate it. Otherwise the only thing to check is that your firewall allows outgoing 5228 for reliable Android notifications.
To find out whether port 5228 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.