Synology DSM: 1,175,121 Fingerprint Matches Where File Storage Meets Remote Access

The count

ZoomEye returns 1,175,121 matches for app="Synology-DSM", collected on 2026-09-24. The fingerprint identifies the web interface of DiskStation Manager, the operating system that runs on Synology network attached storage devices.
The count describes services presenting that signature. No authentication was attempted against any address.

What a NAS actually is

A network attached storage device holds files, and the interface that manages it also manages the identity to reach those files. Modern NAS platforms ship an application ecosystem: file synchronisation, photo libraries, mail, calendar, backup targets and virtualisation hosts. Each of those is a service with its own authentication and its own data.
That combination produces a familiar division of opinion. Administrators who use the device for backup and shared storage treat it as infrastructure. Administrators who use its applications treat it as a service that has to be reachable from anywhere. Both views describe the same device, and the second one usually prevails.

Why these devices end up reachable

Remote access on a consumer or small business NAS is enabled through a vendor relay service, a port forward on the router, or a dynamic DNS name. Each of those makes the interface answer from the public internet, and each of those is a convenience feature rather than a requirement.
The device also tends to hold the data that matters most to a small organization: the shared file store, the backup copies and, frequently, the configuration backups of the estate.

Controls that fit a small environment

The vendor publishes practical guidance, and the two controls with the highest return are boring. Enable the built-in firewall and restrict administrative access to the local network, or to an explicit list of addresses, so that the management interface cannot be reached from the internet at all. Configure multi-factor authentication for administrative accounts, which removes the value of a stolen password.
Then reduce the exposed application surface. Remote access through a relay service or a VPN is safer than a forwarded port, and the file synchronisation clients used by staff are the addressable case for it.

Verification and review

Review the accounts on the device, including application-specific ones that are easy to forget, and check the login history for successes from unexpected addresses. Where the device can send logs to a syslog server, enable that: a NAS that records only to itself keeps the record on the disk that is the target.

Implications

An exposure fingerprint is a useful inventory tool here because these devices are deployed by the business rather than by the IT function, and they rarely appear in a central asset register. Knowing how many are visible from the internet is the first step toward finding out which ones the organization owns.

References

• ZoomEye search for app="Synology-DSM": https://www.zoomeye.ai/
• Synology knowledge base: firewall setup guidance: https://kb.synology.com/en-global/DSM/tutorial/How_to_set_up_a_firewall_on_your_Synology_NAS