ZoomEye: 1,032 Docker daemons with exposed API vs 1.4M hosts on port 2375

A ZoomEye analysis shows that a query for port 2375 returns 1,437,638 hosts, while a Docker fingerprint on the same port yields only 1,032. The distinction matters for assessing the CARBONATO campaign targeting Docker daemons with unauthenticated Remote APIs.

• Query app="Docker" && port="2375" returned 1,032 hosts
• Port-only query for 2375 returned 1,437,638 hosts
• http.header.server="Docker" returned 59,902 matches
• banner="Docker" returned 354,334 matches