ZoomEye finds 51K exposed Overseerr and Ombi portals with no app signatures

ZoomEye index queries on 28 October 2026 returned 8,928 hosts titled Overseerr and 42,810 titled Ombi, with no application fingerprint for either product. Nearly all matches answer on port 443 behind a reverse proxy rather than the documented 5055 and 3579.

• Overseerr: 8,928 hosts, 1,672 on port 443 and just 1 on 5055
• Ombi: 42,810 hosts, 3,390 on port 443 and none on 3579
• Queries app="Overseerr" and app="Ombi" returned 0 results
• The portals store API keys for Sonarr, Radarr, Prowlarr and media servers