Coolify: 70,210 titles against 3 fingerprints, and the port that explains the gap

Self-hosted platforms that deploy other software hold deploy keys, environment variables, and database passwords. Coolify is one of them, and its public footprint on 23 October 2026 produced the most unusual set of numbers in this batch.

The three measurements

ZoomEye returned 70,210 matches for title="Coolify", 3 matches for app="Coolify", and 66,831 matches for title="Coolify" && port="8000".
The application fingerprint number is almost useless: three is too small to describe anything, and it suggests the scanner has no stable response signature for the product. The title number is large. The port-constrained number is nearly as large.
That last relationship is the finding. Ninety-five percent of the title matches sit on port 8000, which is the port Coolify's own installation documentation assigns to its dashboard.

Why that co-occurrence matters

When a product name appears in a page title, the match usually includes documentation, blog posts, and project pages. Those live on 443 or 80, served by a normal web host. They do not live on port 8000.
A population where the title string and the dashboard port coincide at 95 percent is a population of running consoles rather than a population of articles about the product. That is a defensible inference, and it is the kind of inference a count alone will never give you.
It does not follow that 66,831 Coolify servers are exposed and exploitable. It follows that the number is much closer to an installation count than a title count normally is.

What a Coolify dashboard controls

Coolify deploys applications to servers. To do that it stores credentials for the target servers, the source repositories, the container registry, and the environment of every deployed service. The dashboard is the interface to that store.
The architecture decision that matters is how the dashboard talks to the target machines. A Coolify instance that holds SSH keys for a fleet of servers is a single point of compromise for that fleet. A deployment where the same instance is reachable from the internet without a network restriction is a single point of compromise with a public address.
Coolify's own documentation covers securing the dashboard, and the interesting question for an operator is not whether the product has a security feature but whether it was configured before the first deploy.

Turning the number into a decision

The count gives three options. If you do not run Coolify, the number is context: a large installed base with a predictable port means automated scanning against it is worth someone's time. If you run one instance, the check is whether port 8000 is reachable from the internet at all, and whether the account holding the deploy keys is separate from the account you use daily. If you run several, the question becomes whether they share credentials, because shared credentials across instances turn one compromise into a fleet compromise.
The port observation also gives a cheap external check that does not require authentication. A host answering on port 8000 with a Coolify title is presenting the dashboard. Whether it then requires a login, a second factor, or nothing at all is visible only in a browser, which is the boundary between what this article can state and what only you can test on your own systems.

The measurement lesson, stated carefully

Three fingerprints and 70,210 titles is not a contradiction. It is a fingerprinting gap on one side and a string match on the other, joined by a port constraint that happens to be unusually informative.
Report the numbers with their queries and the collection date. Say that the port co-occurrence is consistent with running dashboards. Avoid saying that the hosts are unsecured, because nothing in the data supports that, and avoid the opposite claim that the number is meaningless, because the port correlation is evidence.

Practical actions

Move the dashboard off the default port and behind a proxy that enforces authentication and source restrictions. That single change moves a host out of this dataset and out of most automated scans.
Separate the credentials. A Coolify instance should not use a deploy key that also grants access to unrelated infrastructure, and the target servers should accept that key only for the operations Coolify performs.
Log the dashboard's authentication events and review them for attempts that succeed after a burst of failures. A public dashboard on a predictable port receives that traffic continuously, and the one success that matters is easy to lose in it.

References

• Coolify installation documentation, https://coolify.io/docs/installation
• Coolify project repository, https://github.com/coollabsio/coolify
• ZoomEye AI query results collected 23 October 2026 for title="Coolify", app="Coolify", and title="Coolify" && port="8000", sub-type all