1,551 Open Elasticsearch Endpoints: Reading a Familiar Exposure Number Carefully
Elasticsearch on port 9200 is one of the oldest recurring findings in internet measurement. A ZoomEye query for port:9200 returned 1,551 results in September 2026. The number is small compared with the headline figures that circulated years ago, and the change is more interesting than the absolute value.
What the query returns
A ZoomEye search for port:9200 returned 1,551 results. Port 9200 is the default HTTP interface for Elasticsearch. The query counts hosts that responded on that port at collection time; it does not distinguish between a secured cluster, an unauthenticated one, and a service that is not Elasticsearch at all but happens to listen on the same port.
That last point is not pedantic. Port-based queries are the least precise form of internet measurement, because a port number is a convention rather than an identifier. A service-specific query, such as one scoped to an Elasticsearch response fingerprint, would be more accurate, but it would also return a smaller and differently composed set.
Why the number is lower than it used to be
The large exposed-Elasticsearch counts of the mid-2010s reflected a specific combination: a default configuration that bound to all interfaces, no authentication enabled by default, and a rapid adoption curve that outpaced operational hardening. Those conditions have changed. Elasticsearch has shipped with security features enabled by default since version 8, and cloud providers now commonly place managed clusters behind private networking.
The 1,551 figure is consistent with a residual population: self-managed deployments on older versions, development instances that were never decommissioned, and clusters deliberately exposed for reasons their owners consider valid.
What the number still tells us
A residual population is not a solved problem. Every host in that count is a potential data exposure, and Elasticsearch clusters frequently hold logs, application data, and sometimes credentials. The historical pattern for this class of exposure is that attackers scan for it continuously and automatically, because the cost of finding an open cluster is near zero.
The useful reading is that the exposure is now concentrated rather than widespread. That changes the defensive approach. A broad awareness campaign is no longer the right tool; targeted identification of the specific hosts that remain exposed is.
Using the data
Query port:9200 restricted to your own address ranges. For any result, verify three things: whether the service is actually Elasticsearch, whether authentication is enabled, and whether the data it holds justifies the exposure. In most cases the correct outcome is to remove the public binding and reach the cluster through a private network or an authenticated proxy.
For organisations that need external access, the control is an authenticated reverse proxy with TLS, not a firewall rule that permits port 9200 from anywhere.
Query and method
- Query:
port:9200 - Result count: 1,551
- Collection: ZoomEye, September 2026
- Scope: hosts responding on the specified port; no service confirmation, version or ownership inference
- Limitation: port-based queries cannot distinguish secured from unauthenticated services ## References
- Elastic, security settings and default configuration documentation. https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html
- ZoomEye, internet asset search. https://www.zoomeye.ai
- ZoomEye EASM platform documentation. https://easm.zoomeye.org/easm/
