While scanning a host with nmap I have discovered an unusual service. The service moves to another port everytime I perform an nmap-scan or try to curl it. I have not yet found any info about similar cases, so I am currently not sure how to move forward. Are there any ways I can try to connect to the service, without the service moving to another port?
This sounds like port knocking. Port knocking is where you connect to a sequence of ports before a port is exposed that allows you to connect to a specific service.
Some people like to use it as an extra security measure to lockdown SSH.
For example lets say I've configured my server to listen on port TCP/1111, then when someone connects to TCP/1111 it will open TCP/2222 and so on until finally port TCP/22 opens and I can SSH to my device.
You can read more about how this works in the below link.