Automatic security check · Public OSINT only
Company website
Elevated risk
Several weak public signals. Treat with care until ownership and security posture are confirmed. Passive OSINT only · inventKeys=false.
- High concern
- Elevated risk
- Caution advised
- Trusted — verify
- Strong protections
elastic.co security check
Public OSINT valuation for elastic.co: grade D (46/100). Title signal “Elastic: The search database for AI | Search, AI agents, Observability, and Security | Elastic”. 1 security headers present, 7 commonly expected headers missing. This is a defensive surface review — not a penetration test.
Company website · Services · Social
Company website
Services & products
- AutoOps Easy cluster management with performance recommendations, resource utili
- Financial services
- Get started Follow along with beginner guides for each solution
- Docs Learn how to use all of Elastic's products and features
- Elasticsearch Labs Learn how to build with the latest features and abilities
- Consulting Drive success with custom support and consulting services
- Pricing
- Explore the platform
Social & LinkedIn
- No social or LinkedIn company links found on the scanned pages.
Links are extracted from public crawl HTML only. We never invent profiles or product pages.
Research engines · Complete scan
This complete report delivers web-check-class passive modules to customers — DNS, TLS, headers, mail auth, archives, CT logs and more — researched in the spirit of Lissy93/web-check. Port scan, traceroute and Shodan stay off by policy. Run a live check on the security-check tool for the full interactive dashboard.
Connect this report to your website
Add a free badge that links visitors to this official USA24 security report. You get referral traffic and a backlink; customers can verify the dossier.
Trustpilot · Glassdoor
Hosting · IP · map
- IP34.107.161.234
- ASN—
- Hosting—
- Geo—
- Queryelastic.co
- IP34.107.161.234
- ASN—
- TraceICMP traceroute off by policy
Sources: DNS · ipwho.is geolocation · OpenStreetMap embed. Soft-fail if geo blocked · inventKeys=false.
Domain registration · business age
Public RDAP / WHOIS only. Soft-fail when WHOIS is blocked — we never invent registrar or age.
How we scored elastic.co
Positive signals
- TLS handshake OK (TLSv1.3).
- Content-Security-Policy observed.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- Final HTTP status 200 at https://www.elastic.co/.
Risk signals
- HSTS header missing on the final HTTPS response.
- X-Content-Type-Options missing.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- X-Powered-By disclosed: Next.js.
Findings
- TLS handshake OK (TLSv1.3).
- HSTS header missing on the final HTTPS response.
- Content-Security-Policy observed.
- X-Content-Type-Options missing.
- Set-Cookie present but Secure/HttpOnly incomplete on sampled header.
- X-Powered-By disclosed: Next.js.
- DNS resolves publicly (A/AAAA).
- robots.txt is publicly available.
- Final HTTP status 200 at https://www.elastic.co/.
Technical details
DNS
resolved- A
- 34.107.161.234
- AAAA
- 2600:1901:0:1f6d::
- PTR
- 234.161.107.34.bc.googleusercontent.com
- error
- —
TLS / certificate
ok- version
- TLSv1.3
- cipher
- TLS_AES_256_GCM_SHA384
- issuer
- Let's Encrypt
- notAfter
- Jan 5 01:00:33 2027 GMT
- SAN sample
- appsearch.elastic.co, artifacts-no-kpi.elastic.co, artifacts.elastic.co, artifacts.security.elastic.co, blog.elastic.co, canvas.elastic.co, charge.elastic.co, community-conference.elastic.co
- error
- —
HTTP & security headers
1 present- finalUrl
- https://www.elastic.co/
- status
- 200
- server
- nginx
- x-powered-by
- Next.js
- present
- content-security-policy
- missing
- strict-transport-security, x-content-type-options, x-frame-options, referrer-policy, permissions-policy, cross-origin-opener-policy, cross-origin-resource-policy
- cookie Secure
- True
- cookie HttpOnly
- False
Tech fingerprint (public)
passive- title
- Elastic: The search database for AI | Search, AI agents, Observability, and Security | Elastic
- generator
- —
- tech
- React, Next.js, Google Analytics
- script hosts
- cdn.optimizely.com, x
- description
- Powered by Elasticsearch. Ready to deploy your data? Start free.
Company presence (crawl links)
extracted- companyWebsite
- https://www.elastic.co/
- serviceLinks
- AutoOps Easy cluster management with performance recommendations, resource utili: https://www.elastic.co/platform/autoops, Financial services: https://www.elastic.co/industries/financial-services, Get started Follow along with beginner guides for each solution: https://www.elastic.co/getting-started, Docs Learn how to use all of Elastic's products and features: https://www.elastic.co/docs, Elasticsearch Labs Learn how to build with the latest features and abilities: https://www.elastic.co/search-labs, Consulting Drive success with custom support and consulting services: https://www.elastic.co/consulting, Pricing: https://www.elastic.co/pricing, Explore the platform: https://www.elastic.co/platform
- socialLinks
- none found
Hosting / IP geolocation
unavailable- IP
- 34.107.161.234
- A records
- 34.107.161.234
- AAAA
- 2600:1901:0:1f6d::
- PTR
- 234.161.107.34.bc.googleusercontent.com
- ASN
- —
- Hosting / ISP
- —
- City
- —
- Region
- —
- Country
- —
- Coords
- —
- source
- —
- error
- HTTP Error 429: Too Many Requests
RDAP / registration
unavailable- domain
- elastic.co
- registrar
- —
- registry
- —
- registry location
- —
- created
- —
- age_days
- —
- expires
- —
- nameservers
- —
- status
- —
- error
- HTTP Error 404: Not Found
Public well-known
passive- /.well-known/security.txt
- HTTP 404
- /robots.txt
- HTTP 200 · found
- /security.txt
- HTTP 404
More indepth need for a intelligence? -Visit http://companyforensics.org