Mattermost title matches require ownership checks

Mattermost provides team messaging, file sharing, integrations, and administrative controls. A public login page can indicate a collaboration service that belongs in an asset inventory. It can also be a demonstration, a documentation page, a proxy error, or a site that merely uses the product name. The first job is ownership and role, not a vulnerability verdict.

What ZoomEye returned

On 2026-11-03T04:15:18Z, a ZoomEye SDK query with page=1 , pagesize=1 , and sub_type=all returned 29,906 total matches for title="Mattermost" . The same run returned 835,861 for app="Mattermost" . The application clause is much broader than the title clause, so the title result is the more conservative starting observation. It still does not prove that every result is a live Mattermost server.

This is a count-only measurement. It does not show the number of vulnerable servers, the number with local login enabled, or the amount of message data exposed.…