# Rancher on 23,600 observed hosts: a management console with credentials for many clusters > Source: > Published: 2026-10-05 18:40:29+00:00 A ZoomEye fingerprint query for app="Rancher" ([result list](https://www.zoomeye.ai/searchResult?q=YXBwPSJSYW5jaGVyIg%3D%3D)) returned 23,600 matching hosts at collection time, with sub_type=all, page 1 and page size 1. Rancher is a Kubernetes management platform, and the relatively modest count fits a product that is usually deployed inside an organisation rather than on a public address. Rancher manages clusters rather than running application workloads directly. The web interface listens on 443 by default, with the original HTTP port 80 available for redirects. A Rancher server stores the credentials it uses to talk to every managed cluster, along with user accounts, roles and project assignments. That is a centralised trust store by design, and it is the reason the console is a high value target: an attacker who reaches it with valid credentials can act across the whole estate, and an attacker who finds an authentication weakness inherits the same reach. Historically the product shipped with a bootstrap password that had to be set on first login. Deployments that were stood up in a hurry and never finished that step are the ones where a default credential can still work. A fingerprint match indicates that a host looks like a Rancher server. It does not confirm reachability, credential state or the number of clusters behind it. The value of the number is in the question it raises: whether any management console in your estate is reachable from a network that the console was never meant to serve.