Internet-Security.com TCP port 9212 details

Elasticsearch and OpenSearch can expose their HTTP REST API on TCP/9212 when multiple nodes run on the same host: by default they bind to the first free port in the 9200–9299 range (e.g., 9200, 9201, …), so the 13th node might use 9212.
This is seen in real deployments such as multi-node Elastic Stack or OpenSearch clusters launched via Docker Compose or on lab/dev servers where several nodes share a machine.
If you find 9212 open and it returns Elasticsearch/OpenSearch banners or JSON (e.g., “cluster_name”, “tagline”: “You Know, for Search”), it’s likely one of these services’ HTTP endpoints.

TCP 9212