Home and Small Business Storage on the Public Internet: Synology, QNAP and Plex

ZoomEye queries on 26 September 2026 returned 21,169,246 matches for app="Synology", 2,691,433 for app="QNAP" and 507,842 for app="Plex". Together these three fingerprints describe a storage tier that sits in homes, clinics and small offices, holds personal and business files, and often runs an application platform on top of the storage itself.

Context and method

The counts come from single ZoomEye queries executed through the search API on 26 September 2026 at 00:38 China Standard Time, with page 1, page size 1 and sub_type all configured. Page size limits the records returned per response, so each figure is the platform's overall match total for that dork.

What the numbers show

Synology's total is roughly eight times QNAP's, and both are an order of magnitude above Plex. Part of that gap reflects relative market share in the small storage appliance segment. Part reflects how identifiable each product is. A network-attached storage appliance presents a login page, a management interface and often a discovery service, all of which a scanner can recognise. Plex Media Server is intended to be reachable for remote playback, and it may advertise itself through a service-discovery protocol rather than a distinctive web response, which would lower its fingerprint count even if the installed base were larger.

Why these devices occupy a sensitive position

A storage appliance is where the data actually lives. It holds documents, photographs, medical records, project archives and, quite often, the backup copies of other systems. It also runs applications. Synology and QNAP both provide package ecosystems that install web servers, databases, version control systems and container runtimes on the same device.
That combination makes the appliance a single point of failure and of compromise. The device is internet-facing for remote access, it authenticates users who may include family members or customers, and it hosts services whose own exposure is rarely reviewed separately from the device that runs them. Ransomware campaigns against these platforms have followed a consistent pattern for years. A flaw in a remote-access feature, mass scanning, encryption of the volume and a demand delivered through the same interface the administrator uses.

Implications and next steps

Disable remote access at the appliance and use a virtual private network for external reach, which removes the exposed surface and keeps the capability. Where remote access must stay enabled, restrict it to the vendor's own relay service instead of publishing the management interface, and confirm that the administrative account does not use the default username and is protected by more than a password where the platform supports it.
Audit the installed packages. A package that has not been updated since it was installed is a common finding, because appliance updates are applied to the operating system while applications inside it are managed separately.
Most importantly, verify that the appliance is not the only copy of anything. A backup target that is consistently reachable from the network it protects can be encrypted along with the primary data, and offline or immutable copies are the control that changes that outcome.

Scope and limitations

These are point-in-time fingerprint counts observed from ZoomEye's vantage points. They include hosting provider and research ranges, and they count each reachable node separately, so a single organisation with many devices contributes many matches. The figures describe internet reachability as identified by fingerprinting. They do not indicate whether a device is patched, whether authentication is configured securely, or whether any device has been accessed. Nothing here measures exploitation or data loss.