ZoomEye finds over 30,000 exposed Matomo installations

ZoomEye indexed 30,534 Matomo installations by application signature and 34,631 by page title. The analytics platform must accept traffic from any visitor, so its tracker and reporting console often share the same host and port.

• ZoomEye: 30,534 matches for app="Matomo" and 34,631 for title="Matomo"
• For comparison: Umami 11,584 vs 18,133, Plausible 9,483 by title
• The tracker must stay public, but the reporting console and API tokens must not
• Risks include full visit-log export, permission changes and personal-data exposure