ZoomEye: 15.3M Devices Exposed on WinRM Port 5985

A ZoomEye scan on 25 September 2026 found 15,307,587 matches on port 5985 (WinRM over HTTP) and 1,019,437 on port 5986 (WinRM over HTTPS). The 15-to-1 ratio reflects that Windows enables the HTTP listener by default, while HTTPS requires a provisioned certificate.

• Port 5985 (WinRM HTTP): 15,307,587 matches
• Port 5986 (WinRM HTTPS): 1,019,437 matches
• WinRM provides full remote command execution
• Port counts do not reveal whether authentication is required