Download websites that use Grafana

About Grafana

Almost everything we detect on the public web is meant to be there. Grafana is different, because a dashboard is an operations tool and the natural home for one is behind a VPN or an internal hostname. Finding it on a public address means somebody exposed it deliberately, for a status page or a dashboard shared with customers, or exposed it accidentally, and the second case is the more interesting one.

Grafana is developed by Grafana Labs in Go and released under AGPL v3, with the project dating to 2014. Licence and language both shape how the population behaves. An open source project can be installed by anyone at no cost, on a spare virtual machine, in a container, or as part of a bundled monitoring stack somebody deployed once for a demo and never removed, so the installed base is enormous and largely invisible. What reaches a crawler is only the fraction pointed at a public hostname.

As of October 2026 we see Grafana on 80 sites. Reading a number like that as market share would be a serious mistake. The count measures public endpoints rather than deployments, and the gap between the two is large and unmeasurable from outside. What the count does measure well is exposure, meaning how many organisations have an operational monitoring interface reachable from the open internet.

Version data is where the dataset earns its keep for this technology. We hold 42 distinct versions across our detections, and the release we encounter most often is 8.2.6. A spread that wide is what an active release cadence looks like from the outside, and it also means the obvious question, namely which version a given host is running, has a genuinely different answer on almost every host. For a monitoring platform with a published advisory history, the version string on an internet facing instance is not trivia. Anyone assessing exposure across a supplier list, a customer base or an acquisition target is asking precisely that question, and the answer only exists at scale in a dataset that records the version next to the domain.

Three uses come up repeatedly. Vendors of hosted observability treat public instances as self managed deployments with an operational cost attached, which is the substance of their pitch. Security teams and researchers treat the same rows as an attack surface inventory sorted by version. Analysts studying the monitoring market treat the population as a sample that is biased toward the exposed but at least measured the same way in every release, rather than reported by the vendor.

A per-domain lookup tells you what one host is running right now. The export answers the questions that need every row at once: how many hosts are exposed, which versions they run, how the version distribution shifts in the months after an advisory, and which domains appeared or disappeared since the previous release. Watching a version distribution move after a disclosure is a measurement of how fast an ecosystem patches, and nobody can produce it one lookup at a time.

One caveat runs through all of this. A dashboard behind an authentication proxy, on a rewritten path or on a non standard port may never present the signature we match, so the figure is a floor for public exposure and says nothing at all about the far larger internal population.