Port 2375 alone overstates the exposed Docker problem

A ZoomEye query on 30 September 2026 returned 1,437,638 assets on port 2375, but only 1,032 were fingerprinted as Docker. Ports are conventions, so counting by port number overstates the number of vulnerable Docker hosts.

• port="2375" returned 1,437,638 assets; app="Docker" && port="2375" returned 1,032
• app="Docker" — 13,246, banner="Docker" — 354,334, http.header.server="Docker" — 59,902
• Different fingerprints describe different product relationships, not just a port
• ZoomEye counts show exposure, not confirmed compromise