Linkerd: 306 page titles against 27,259 body matches, and a zero on the admin port that is the reassuring part

Service meshes are unusual measurement targets. The interesting components are sidecars, which do not answer on a public port, and control planes, which are usually internal. What ZoomEye can measure is the smaller visible edge: the dashboard, the documentation a proxy happens to serve, and the string "Linkerd" appearing in responses across the internet. Measurements taken on 26 October 2026 show how wide the gap between those observations can be.

The observations

All queries ran against ZoomEye with sub_type="all" and pagesize=1, so totals describe matched assets rather than retrieved records.
| Query | Matches |
| --- | ---: |
| title="Linkerd" | 306 |
| http.body="Linkerd" | 27,259 |
| app="Linkerd" | 0 |
| port=4191 | 0 |
The 306 title matches are the tightest signal: pages whose heading names the product. That number is small because a mesh dashboard is normally placed behind authentication on an internal network, and a mesh that is working correctly has no reason to be publicly reachable.
The 27,259 body matches are almost entirely not mesh consoles. Linkerd appears in error pages served by proxies, in header echoes, in documentation mirrors, and in responses from applications that log their own environment. A body match means the string appeared; it does not mean the responding component is Linkerd.
The zero on app means ZoomEye has no application fingerprint that matches, so this query cannot be used to size the population at all.

Why the 4191 result matters more than the others

Linkerd's proxies expose an administrative endpoint on a local port, historically 4191, used for metrics and diagnostics. A zero match on that port across the whole index is a meaningful negative result. Diagnostics endpoints on service proxies reveal upstream routes, destination identities, and per-route counters — the map of everything the proxy is doing.
A zero here does not prove nobody exposed it. It proves that hosts answering on port 4191 did not present a response ZoomEye recorded as a match, and that the dataset contains no asset for it at the moment of the query. For a control that should be bound to localhost, a zero is the expected outcome on a healthy population, and it is worth noting when a measurement agrees with the design rather than contradicting it.

What a mesh actually changes about exposure

Linkerd's default posture is mutual TLS between meshed workloads, with identity derived from the workload's service account and certificates rotated automatically. That is a real improvement over plaintext service-to-service traffic, and it is invisible to an external measurement.
The improvement has boundaries worth stating. It covers traffic between meshed pods, not traffic arriving from outside the mesh through an ingress controller. It authenticates the workload, not the human who deployed it. And it does not remove the need to authorise: a mesh proves who is calling, and the application still decides what the caller may do.
The operational artefacts are where the security decisions accumulate. Certificate authority material, the identity of every meshed workload, and the policy objects that restrict which workloads may talk to which are all configuration with a blast radius. A mesh that encrypts everything and authorises nothing has moved the problem rather than solved it.

The practical reading

A title count in the hundreds describes dashboards someone put on the internet. The useful follow-up is a naming exercise: identify the dashboards your organisation owns, confirm they sit behind an identity-aware proxy, and check whether the mesh's authorisation policy objects exist at all or were left at their permissive defaults.
The body count is not a population. It is a reminder that product names travel further than products do, and that a measurement which reports only the largest number is reporting the least useful one.

References

• Linkerd features documentation: https://linkerd.io/2/features/
• Linkerd source repository: https://github.com/linkerd/linkerd2
• ZoomEye search platform: https://www.zoomeye.ai/

Measurement note

Queries: title="Linkerd", http.body="Linkerd", app="Linkerd", port=4191. Executed 26 October 2026, sub_type="all", pagesize=1, global scope. Counts describe matching assets, not confirmed vulnerabilities.