A reachable blackbox_exporter accepts a target and a request path
The blackbox exporter runs probes from the network where it is installed. A caller supplies a target and selects a module, and the exporter returns measurements about the attempt. The default port is 9115. Port counts and body counts for this service differ sharply, which makes it a useful example of why one field cannot answer an exposure question.
The measurements
The count-only queries from November 5, 2026 were:
| Query | Matches | UTC time |
|---|---|---|
port="9115" |
3 | 2026-11-05T00:40:30Z |
app="blackbox_exporter" |
0 | 2026-11-05T00:40:31Z |
http.body="blackbox_exporter_build_info" |
21,813 | 2026-11-05T00:40:33Z |
All three queries succeeded. The body count is much larger than the port count. That does not mean 21,813 internet-facing exporters exist. A search over HTTP bodies can include documentation, dashboards, logs, and asset records containing the metric name. The port count is a narrower network observation, but it still does not identify the process behind the port.
The zero application result confirms that the application field is not a reliable detector for this exporter in the observed data. A security team that only searches for app="blackbox_exporter" would see no inventory.
The exporter is an active probe service
Prometheus documents the blackbox exporter as a multi-target exporter. Prometheus passes a target and module to the /probe endpoint. The exporter can perform HTTP, HTTPS, DNS, TCP, ICMP, and gRPC probes, depending on its configuration and permissions.
That design is valuable for checking availability from a monitored network. It also means an exposed endpoint may let an untrusted caller cause the exporter to make network requests. The exporter is not a general proxy and its result is limited to probe metrics, but the request can still reach addresses available from the exporter host.
Review the configured modules and permitted targets. Restrict the endpoint to the Prometheus server or a monitoring network. Enable TLS and authentication at the exporter's web layer where possible, and keep the web configuration outside the public document tree.
Do not infer from the body count
The 21,813 body matches show that a metric name is a weak asset signature. The string can appear in a GitHub page, a monitoring rule, a copied configuration, or an unrelated response. A validated probe should check the live /probe path with an approved target and module, then inspect the returned metric family and status.
For owned assets, compare the result with the Prometheus scrape configuration. The exporter should have a known owner, module set, outbound network policy, and monitoring source. Record the target used in the test. Do not probe third-party systems or use a public address as a confirmation target.
Reduce outbound authority
Run the exporter with the smallest network permissions it needs. Do not give it access to management networks it is not supposed to reach. Apply egress policy to the host, and separate probes for untrusted third-party services from probes for internal control planes.
Keep the exporter's configuration under version control and hash it at deployment. A module that changes timeout, TLS verification, or redirect handling changes what the exporter can do. Review those changes as security changes, not only as monitoring configuration.
A practical review sequence
Start with the port and body counts as discovery leads. Confirm the listener on an owned host. Inspect /probe from the monitoring network with a known target. Review the module configuration, outbound routes, and web authentication. Then remove public access or place the endpoint behind the monitoring gateway.
If the endpoint was exposed, preserve its web logs and the surrounding network flows. Check whether an unexpected target was supplied in a probe request. The exporter's own metrics may help with volume and status, but they do not replace the request log.
The counts show a small port population and a large text population. The useful answer is neither number alone. It is the owned endpoint list with a tested target boundary.
Top comments (0)