DEV Community

kozhevniko
kozhevniko

Posted on

Velociraptor: 237 title matches, 15 certificate hits, and an endpoint agent you cannot see

#zoomeye #measurement #endpointsecurity

Velociraptor: 237 title matches, 15 certificate hits, and an endpoint agent you cannot see

Endpoint visibility platforms are hard to count from the outside, and that fact is itself the finding. Velociraptor is an open-source digital forensics and incident response tool that runs an agent on each monitored host and a server that collects, queries and stores the results. When an organisation exposes the server to the internet, the exposure is not a website: it is a query interface over every endpoint in the estate.

What the measurement shows

On 23 October 2026, a set of ZoomEye queries over the global index returned the following counts, all with sub_type=all and a page size of one, so the figures are matched totals rather than samples:

  • title="Velociraptor": 237 matches
  • title="Velociraptor" && port="8000": 2 matches
  • title="Velociraptor" && port="8889": 0 matches
  • title="Velociraptor" && ssl="velociraptor": 15 matches The gap between those lines carries the information. Two hundred and thirty-seven assets carry a page title that names the product. Only two of them present that title on the port most commonly associated with its GUI in documentation, and none present it on the port used by the agent-to-server communication channel in typical deployments.

Reading a small number correctly

A count of two is not evidence that only two Velociraptor servers exist on the internet. It is evidence that two servers answer HTTP on that port with a page whose title contains the product name, in a way the crawler could observe.
Three mechanisms suppress the count. The server is frequently placed behind a reverse proxy that rewrites or replaces the page title. It is frequently bound to a private address and reached over a VPN, so nothing is indexed. And it frequently requires authentication before any HTML that names the product is returned, which leaves the crawler looking at a login page with a generic title.
The certificate figure is interesting for a different reason. ssl="velociraptor" matches text inside the TLS certificate, and it returned 15. That query finds hosts whose certificate mentions the product, which catches deployments that reverse-proxied the interface under a name containing it. It also catches unrelated hosts that mention the word for other reasons. Neither query is a census.

Why the interface matters more than the count

A Velociraptor server holds the results of hunts run across an estate: process listings, file hashes, registry values, network connections, and the artefacts collected during incident response. Query results from a monitored fleet are, in aggregate, a map of the environment.
The server also holds the ability to run new hunts. An interface that can dispatch collection to thousands of endpoints is a control plane, in the same category as a configuration management system or a build server. Its credential store is as valuable as its data store.
That combination makes the placement decision straightforward in principle and frequently muddled in practice. A DFIR platform is often stood up during an incident, given a public address so remote responders can reach it, and then left in place after the incident closes.

What to verify on your own estate

External counts cannot establish which servers are yours. The inventory has to come from configuration data.

  • Enumerate servers by deployment record, then confirm the listening sockets on each. A server that only listens on a private address is not part of any internet-facing population regardless of what a search engine shows.
  • Check the TLS certificate on any externally published interface. A certificate naming the product is a disclosure that costs nothing to avoid.
  • Separate the console from the collection channel. The GUI and the agent-facing service have different trust requirements, and only the GUI ever needs to be near a human.
  • Review who holds API credentials. Programmatic access to the hunt interface is the highest-value credential on the platform, because it converts a read into an action across every endpoint.

Detection notes

The interesting signal is not a scan of a public page, it is the use of the API. Hunt creation and result retrieval are discrete, auditable events. Recording the source address and the credential identity for each is more useful than any perimeter control, because it works whether or not the interface is exposed.
Unexpected client enrolment is the second signal. An agent joining the fleet from an address nobody provisioned is either an onboarding mistake or an attempt to blend into the collection channel.

Where ZoomEye fits

The value of an external index here is not the two hosts it finds. It is the ability to answer a scoping question quickly during an incident: does anything on the public internet advertise this platform, and does the certificate on it name the organisation. That is a starting check, not an inventory, and it should be read alongside internal records rather than instead of them.

References

Top comments (0)