Port 6379 draws 4.9 million answers in a scan that fingerprints only 142 Redis servers

The two counts differ by a factor of about 34,800 ^[15]. Put the other way, the product fingerprint matched roughly 0.003% of what answered on the port ^[16]. Both queries ran against ZoomEye's international dataset with the default all-asset scope ^[1]. The post's author called the fingerprint's coverage of Redis limited for exposure-scoping purposes ^[4]. Limited is a polite word for one match per 34,800 listeners ^[15].

The post argues that the port is the better identifier for Redis, on two grounds. Port 6379 is stable across versions and distributions, and the author wrote that it is not commonly reused by unrelated software in the index ^[17]. Redis's security guidance is also unambiguous, so the population of interest is defined by exposure, with no version or vulnerability to filter on ^[19]. The first ground sits uneasily beside the fingerprint result. If 6379 is rarely reused, the fingerprint is missing almost every Redis server on the port. If it is reused, software other than Redis inflates the 4.9 million ^[3][5].

The port count describes reachability from the scanning infrastructure ^[5]. For an answer on 6379 to be an exposed data store, the listener has to be Redis, it has to accept commands without a password, and the scanner's view has to match an attacker's. The port query speaks to the third condition and assumes the first. The author does not claim more. "A count of five million answers on the port does not mean five million exposed data stores. It means five million services where the question, is this an exposed data store, is worth asking of the owner," the author wrote ^[7].

Redis's documentation deserves credit for stating its deployment rule outright ^[8]. The access model it describes rests on protected mode, a password the operator can choose to set, and a plain statement that Redis is not meant to face the internet ^[9]. The risk sits with network listeners where nobody opted into a password ^[11]. "A service reachable from an untrusted network without authentication is a data store that answers to anyone," the author wrote ^[12].

Of the post's five checks for owned hosts ^[13], the last is the least obvious. It asks owners to make sure Redis saves its persistence files somewhere a client without credentials cannot steer ^[13]. The check is aimed at the file writes that Redis's recovery instructions describe for a reached instance, where configuration permits them ^[10].

For an organisation's own ranges, the author wrote, the port scope is the one that produces a reviewable candidate list ^[18]. The post also recommends that reports state the fingerprint count and the port count, and say which one the analysis relies on and why ^[14].