414,009 ESXi hosts and 1,495,455 answers on port 902: sizing a hypervisor estate from outside

The measurement

Two ZoomEye queries describe the same population from different angles. app="VMware ESXi" returned 414,009 results. port="902" returned 1,495,455.

The fingerprint query counts hosts that presented an ESXi banner. The port query counts hosts that accepted a connection on 902, the port the VMware authentication daemon and the management agent traditionally use. The threefold difference is the useful part, and it needs care before it is read as a statement about the hypervisor population.

Context and method

The queries were run on 26 September 2026 between 04:33 and 04:36 Beijing time, which is 2026-09-25T20:33 to 20:36 UTC:

• app="VMware ESXi"
• port="902"

Both counts come from an internet-wide scan index, and both carry the same limitation. A port match says a socket answered, not that the service behind it is the one commonly associated with that port. A fingerprint match depends on the banner and on the matcher, and a host configured to present minimal information can go uncounted. Neither number says whether authentication succeeded, which version is running or whether the host is reachable from where you sit. Index contents also shift between refreshes, so these counts describe one collection window.

Reading the two numbers

Port 902 has been used by VMware for management and authentication traffic for a long time, which makes it a plausible destination for a port-level query. It is also a number that another service can bind, and there is no rule that reserves it. That is the main reason the larger figure should be treated as an upper bound on the ESXi population rather than an estimate of it.

The direction of the gap is still informative when the numbers are considered together. A fingerprint count lower than a port count is what you expect when a service chooses to answer a port but not to announce a product identity. A fingerprint count much larger than the port count would suggest the opposite problem, that hosts are identifiable but the conventional port is filtered or has been moved.

The ESXi figure itself is a reminder that hypervisor management interfaces are not rare on the internet. An ESXi host holds the virtual machines of everything it runs, and its management interface is the control surface for those machines. When a hypervisor management endpoint is reachable without a network control in front of it, the whole guest inventory sits behind one authentication check.

Next steps with ZoomEye

• Run both queries for the country or network range you are accountable for, and compare the two populations rather than reading either alone.
• Narrow the fingerprint query with a version or a banner term where the index supports it, so that the version distribution is visible and not only the total.
• Repeat the port query over time. A growing 902 population in a specific range usually means new hosts were deployed with a default network configuration.
• For your own estate, confirm exposure from an external vantage point rather than from the management interface, and check whether the management network is reachable from user segments.

ZoomEye is useful for this exercise because it separates the fingerprint question from the port question and lets both be answered for the same range. The divergence is a measurement fact, and deciding what it means requires the internal view that only the operator has. The platform is documented at https://www.zoomeye.org/.

References

• ZoomEye search platform
• VMware documentation on ESXi management network configuration and firewall rules
• VMware security advisories on hypervisor management interface exposure