SkyWalking answers 7,586 titles on 8080 and almost nothing on 12800

Application performance monitoring platforms see the inside of a system: service topology, latency, trace payloads attributed to users, and the errors that carry stack traces. Apache SkyWalking is one of the widely deployed open-source options, and its indexing profile online is instructive because the number you find depends entirely on which door you knock on.

The counts

ZoomEye queries executed on 23 October 2026 with sub_type=all and a page size of one produced matched totals rather than samples:

• title="SkyWalking" returned 7,586
• title="SkyWalking" && port="8080" returned 2,858
• title="SkyWalking" && port="12800" returned 0
• title="SkyWalking" && ssl="skywalking" returned 7
  The third line deserves attention. In SkyWalking's architecture, the OAP server exposes a REST and GraphQL query surface, and the UI is a separate web application that talks to it. Port conventions differ between releases and deployment charts, and a query that assumes one specific port finds nothing because the deployment moved, not because the service is absent.

Three populations inside one number

The 7,586 title matches are not 7,586 equivalent assets. They divide into groups with different risk profiles.
The first group is the UI, reachable through a reverse proxy, usually behind authentication. What it exposes is a dashboard, and what the dashboard can query is the tracing backend.
The second group is the OAP query endpoint, sometimes exposed directly. It is an API, and an API without an authentication layer answers questions. Trace data attributed to a user session or a transaction identifier is a data set that many organisations would classify as internal.
The third group is the agent ingest path, which accepts data from instrumented services. It is not designed to be publicly writable, and it frequently is not authenticated, because the network was assumed to be trusted.

Why tracing data deserves a perimeter decision

A trace record describes what happened during a request. In a well-instrumented application that includes the endpoint, the SQL statement, the external service call, and sometimes the request parameters. In a less careful implementation it includes headers, and headers carry tokens.
Even without payload capture, the topology is sensitive. Which services talk to which, at what volume, with what latency, and where the errors cluster: that is an architecture diagram produced continuously. For an attacker at the reconnaissance stage, it shortens the path from "there is an app" to "here is the component that fails".
The authentication tier matters too. SkyWalking deployments frequently integrate with a single sign-on provider, and that integration is the control that separates a public dashboard from a public data source. Where it was configured, the title match is still indexed because the login page is public; where it was skipped, the data is public too.

Reading low and zero honestly

The certificate query returning 7 is a reminder that external naming conventions vary. A deployment behind a load balancer may present a certificate that names the platform, may present one that names the organisation, or may present nothing distinctive at all.
Zero on port 12800 is not zero deployments. It says that the crawler did not obtain the product's title from a service on that port during the collection window. A server that returns a 401 before any HTML, or that only speaks the query API without a browser page, is invisible to a title query by construction.

What an inventory looks like

The counts are useful for a first pass and useless as an inventory. The internal questions are more concrete.

• Which SkyWalking components exist in each environment, and which of them have a public ingress rule. Chart defaults often publish the UI and leave the OAP port internal; overrides sometimes reverse that.
• Is authentication enforced by the platform or by the proxy in front of it. Both are acceptable; neither is acceptable by assumption.
• Is payload capture enabled. Request and response body capture raises the sensitivity of the trace store by a wide margin, and that decision should be recorded next to the exposure decision.
• Are agents restricted by source address. The ingest path accepts writes, and a network policy is the cheapest control available.

Operational note

Trace retention is usually measured in days, which makes the platform a poor archive and an excellent live view. An attacker who reaches the query API does not need history to be useful; the current minute of traffic across a production estate answers most of the reconnaissance questions they would otherwise have to probe for.

References

• Apache SkyWalking documentation: https://skywalking.apache.org/docs/
• Apache SkyWalking project: https://github.com/apache/skywalking
• ZoomEye queries executed 23 October 2026 with sub_type=all: title="SkyWalking" 7,586; title="SkyWalking" && port="8080" 2,858; title="SkyWalking" && port="12800" 0; title="SkyWalking" && ssl="skywalking" 7