ZoomEye finds 237 Velociraptor instances exposed online

A ZoomEye scan on 23 October 2026 returned 237 hosts with a Velociraptor page title, but only 2 serve it on port 8000 and none on port 8889. TLS certificates mentioning the product matched 15 hosts. An exposed Velociraptor server exposes hunt results and the ability to dispatch new collections across an estate.

• 237 hosts carry the Velociraptor title, only 2 on port 8000
• 15 matches for the product name inside TLS certificates
• An exposed server can dispatch collection to thousands of endpoints