Loading threats
Client performs a direct request to the Elasticsearch /_cat/indices endpoint and retrieves a successful response without preceding generic web discovery or multi-protocol probing. This behavior indicates targeted Elasticsearch reconnaissance focused on enumerating available indices, document counts, and storage size to assess data exposure. Unlike broad internet scanners, the interaction is Elasticsearch-aware from the start, suggesting tooling or operators specifically searching for open clusters rather than conducting general service fingerprinting.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 134.122.176.63 | 83% | 1,851 | 1,825 | 🇸🇬 SG | AS152194 | 2026-04-18 |
| 138.197.16.14 | 92% | 1,452 | 1,083 | 🇺🇸 US | AS14061 | 2026-04-17 |
| 146.190.134.221 | 92% | 1,018 | 818 | 🇺🇸 US | AS14061 | 2026-04-11 |
| 45.84.107.74 | 99% | 951 | 203 | 🇸🇪 SE | AS214503 | 2026-04-18 |
| 193.143.1.23 | 88% | 814 | 814 | 🇷🇺 RU | AS198953 | 2026-04-18 |
| 185.246.188.74 | 98% | 543 | 100 | 🇳🇱 NL | AS200651 |
| 2026-04-18 |
| 138.199.60.32 | 88% | 526 | 526 | 🇸🇬 SG | AS212238 | 2026-03-09 |
| 185.242.226.92 | 97% | 494 | 452 | 🇺🇸 US | AS202425 | 2026-04-18 |
| 194.127.167.102 | 72% | 472 | 74 | 🇪🇪 EE | AS43357 | 2026-02-26 |
| 157.245.240.222 | 98% | 470 | 387 | 🇺🇸 US | AS14061 | 2026-02-19 |
| 157.245.243.206 | 98% | 454 | 449 | 🇺🇸 US | AS14061 | 2026-03-19 |
| 193.32.249.224 | 87% | 433 | 433 | 🇳🇱 NL | AS39351 | 2026-03-22 |
| 157.230.81.78 | 99% | 396 | 386 | 🇺🇸 US | AS14061 | 2026-02-23 |
| 165.22.3.223 | 99% | 386 | 345 | 🇺🇸 US | AS14061 | 2026-02-19 |
| 24.199.94.250 | 100% | 366 | 363 | 🇺🇸 US | AS14061 | 2026-03-12 |
| 143.198.185.55 | 99% | 350 | 338 | 🇺🇸 US | AS14061 | 2026-02-25 |
| 142.93.195.32 | 97% | 347 | 347 | 🇺🇸 US | AS14061 | 2026-04-06 |
| 134.209.66.7 | 96% | 336 | 327 | 🇺🇸 US | AS14061 | 2026-03-16 |
| 193.32.126.232 | 78% | 336 | 167 | 🇫🇷 FR | AS39351 | 2026-04-16 |
| 157.245.244.52 | 98% | 320 | 316 | 🇺🇸 US | AS14061 | 2026-03-16 |