8094/tcp open on WAN port reveals SF-OS

Hi there,

Just been nmap'in the WAN port of an XG, with pretty much the default configuration and no DNAT/SNAT or any services in the protected zone opened at all. The scan reveals the port 8094/tcp and further reveals that the service SSL certificate used common name = "SophosApplianceCertificate_XXX" along with the appliance serial number.

Is this by design? I guess it's the SPX portal behind this.
EDIT: Ahh and yes, no trace of the scan in any logs...

Any thoughts?

Appart from that, coming from a pure UTM home/labs usage, i've been reluctant to even learn a bit the XG and i'm very pleased. 
My system looks really responsive with very minimal resources (VM).

Cheers,

M-

EDIT2: way to unmap the SPX service on your WAN port here: 
https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/77017/how-to-block-port-8094-on-sophos-xg