Usually a Transmission BitTorrent web UI or a Prometheus Pushgateway — both default here.
IANA has 9091 registered to a private assignment called xmltec-xmlmail that you will essentially never meet. In practice the port belongs to two popular pieces of software: Transmission's RPC and web interface (the /transmission/web/ UI behind transmission-daemon), and the Prometheus Pushgateway, which listens on 9091 by default for metrics pushed by batch jobs. On a home or lab network a listener here is almost always Transmission on a NAS or seedbox; in a monitoring stack it is the Pushgateway.
Do not expose
Transmission's RPC lets a caller add torrents and set the download directory, and older builds shipped with weak or absent authentication; the Pushgateway accepts unauthenticated metric writes and deletes. Keep both on the LAN or behind an authenticating reverse proxy.
$ curl -sS -m 5 -o /dev/null -w '%{http_code}\n' http://TARGET:9091/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.