Prometheus's web UI and API by default, and Cockpit's web console on Linux servers — two very different things on one number.
A fresh Prometheus serves its status page and HTTP API on 9090, so on a monitoring host that is almost certainly what it is. On a Linux server it is at least as likely to be Cockpit, whose web console is reached at https://host:9090 and which logs you in with system credentials. IANA registers 9090 as websm (IBM Web-based System Manager). Tell them apart by whether the port speaks TLS and what the root path returns.
Expose with care
Cockpit is designed to be reached over HTTPS with real logins; Prometheus is not — it has no authentication out of the box and its API exposes every metric you collect, so put it behind a proxy or Prometheus's own web config.
$ curl -sI http://TARGET:9090/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.