Download websites that use Kibana

About Kibana

Kibana was built to be looked at by the people who run a system, not by the people who visit it. The dashboards it draws sit in front of an Elasticsearch cluster and exist for log triage, capacity planning and incident review, which is work that normally happens behind a login. Finding a console like that while crawling the public web is already a finding in itself, because the software is answering to whoever asks rather than to an internal audience.

As of October 2026 we record Kibana on 14 sites, a small number by web-scale standards and exactly what a tool that belongs on an internal network should produce. Two very different things generate that count. Some hosts publish observability or status dashboards on purpose, for a community, a customer base or a public infrastructure project. Others are consoles that were stood up for an evaluation, wired to a public address, and never closed again. Our data cannot separate the two, and anyone using the list should sort them by hand before drawing conclusions.

The version picture is unusually informative here. Our index holds 2 distinct release strings for this entry, and the value that recurs is 6.1.2. A dashboard tool still serving an old release is rarely a deliberate engineering choice. Old release strings on a publicly reachable console usually mark a deployment nobody owns, which is the same population a security researcher, an internal audit team or a managed observability vendor would each want for their own reasons.

Catalogued under Analytics and written in JavaScript, the software comes from Elastic and has been around since 2013. Licensing in this product family has changed more than once over the years, so treat the Apache 2.0 label on our entry as a note on the catalogue record rather than as guidance about what any particular deployment may be used for.

A word about the taxonomy belongs here too. Filed under Analytics, the entry sits alongside visitor measurement scripts, and anyone scanning that category could reasonably assume one family of software. The two have almost nothing in common in practice. A page analytics tag is placed on a site deliberately to measure its visitors. An operations console is infrastructure that happens to be reachable from outside. Segmenting our analytics category for market sizing without separating entries like this one inflates a market the software was never sold into.

Detection depends on markers in the served response, so the count is a floor. A console behind single sign-on, a reverse proxy that rewrites the page, an unusual port or an access control list will all keep an install out of our data even when the install is perfectly real. What we miss is invisible instances, not phantom ones, so the direction of the error is known.

A per-domain lookup answers whether one host runs the software. A downloadable list answers a question a lookup structurally cannot: how large the exposed population is, how it splits by release string, and whether it shrinks or grows between exports. Counting that population once tells you the size of a problem. Counting it again next month tells you whether anyone is fixing it.