Check an IP Address, Domain Name, Subnet, or ASN
45.156.128.108 has a threat confidence score of 72%. This IP address from Portugal (AS211680, Sistemas Informaticos, S.A.) has been observed in 82 honeypot sessions targeting HTTPS, HTTP, SSH, IMAP, TELNET and 3 other protocols. First observed on February 7, 2026, most recently active March 19, 2026.
Client performs a direct request to the Elasticsearch /_cat/indices endpoint and retrieves a successful response without preceding generic web discovery or multi-protocol probing. This behavior indicates targeted Elasticsearch reconnaissance focused on enumerating available indices, document counts, and storage size to assess data exposure. Unlike broad internet scanners, the interaction is Elasticsearch-aware from the start, suggesting tooling or operators specifically searching for open clusters rather than conducting general service fingerprinting.
Identifies HTTP requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration.
Identifies HTTPS requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration