Media request systems occupy an odd position: they are consumer software, they hold API keys to a dozen other services, and they are installed by people who are good at this but not necessarily thinking about exposure. The index has an unusually clean view of them.

The measurements

Queries against the ZoomEye index on 28 October 2026:

  • title="Overseerr" returns 8,928, of which title="Overseerr" && port=443 returns 1,672 and title="Overseerr" && port=5055 returns 1.

  • title="Ombi" returns 42,810, of which title="Ombi" && port=443 returns 3,390 and title="Ombi" && port=3579 returns 0.

  • app="Overseerr" returns 0 and app="Ombi" returns 0.
    Two observations follow immediately. First, neither product has an application fingerprint, so every number available is name-based. Second, almost none of the matching assets answer on the product's documented default port — 5055 for Overseerr, 3579 for Ombi — which tells you that the sample is dominated by deployments sitting behind a reverse proxy on 443.
    That second point is not a footnote. A deployment behind a reverse proxy is a deployment someone bothered to configure, which usually correlates with TLS and, sometimes, with authentication in front of the app.

A caveat that must accompany the number

String-based title matching is vulnerable to compound words. A title query for "Ombi" can match pages titled with longer words containing that substring, and 42,810 is high enough relative to Overseerr's 8,928 that some of the difference is likely to be noise rather than a genuine six-to-one adoption ratio. Anyone quoting these figures for a decision should verify a sample of the responses rather than trusting the total.
The measurement claim that survives that caveat is directional and still useful: these are mainstream self-hosted applications with tens of thousands of internet-reachable instances, and they have no product signature in the index.

What the software connects to

This is where the category earns attention. Overseerr and its successor Jellyseerr take media requests from users and then act on them by calling downstream services. Ombi does the same and also integrates with Sonarr, Radarr, Prowlarr and one or more media servers.
Every one of those integrations is an API key. The request system stores them, uses them, and typically runs then on a schedule. A compromise of the request portal yields the keys that control the download and library automation chain — which is to say the entire content pipeline, plus whatever access those tools have to storage.
The user database is a second asset. These systems authenticate households or small teams, which means email addresses, hashed passwords, and in some configurations a link into an external identity provider.
Neither asset justifies panic. Both justify knowing whether the portal answers to the internet without a login.

The configuration question worth asking

The recurring pattern in this category is an application behind a reverse proxy with authentication for the main entry point and a direct path to the application port that bypasses it. The attacker does not break the proxy; they find the container port that was published to the host for convenience.
Three checks are worth the time. Confirm the application port is bound to loopback rather than to all interfaces. Confirm the reverse proxy enforces authentication at the proxy layer for anything that is not a public page. And confirm the API keys stored in the application are scoped — if the key grants full administrative access to the automation stack, a request portal compromise is an automation stack compromise.
Finally, treat the request portal as a system with credentials rather than as a convenience front end, because that is what it is. It holds keys to systems that write files to disk on your behalf.

Why this category is under-measured

Products in this space are young, change names, get forked, and are deployed by individuals rather than by organisations with an asset register. They rarely ship a signature that an indexer can match. The result is a category that is large, credential-rich and almost invisible in product-based inventories.
The fix is not a better query. It is a habit: enumerate what your users have installed on infrastructure that answers to your name, because the shadow-IT tier in 2026 is not a spreadsheet of SaaS subscriptions. It is a container host with a reverse proxy and eight services behind it.

References

  • ZoomEye search, queries executed 28 October 2026: title="Overseerr" 8,928 (port 443: 1,672; port 5055: 1); title="Ombi" 42,810 (port 443: 3,390; port 3579: 0); app="Overseerr" 0; app="Ombi" 0: https://www.zoomeye.org

  • Overseerr project documentation: https://overseerr.dev

  • Ombi documentation: https://ombi.io