LeakIX - Host 120.26.194.8

Host 120.26.194.8

China

Hangzhou Alibaba Advertising Co.,Ltd.

CentOS Linux 7 (Core) 5.10.60-9.al8.x86_64

MySQL is publicly available

MySQL is currently open without authentication.

Additionally a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 120.26.194.8
Port: 3306

First seen 2022-07-06 21:04
Last seen 2024-11-01 00:13
Open for 848 days

Severity: critical
Fingerprint: cf350410ecceb5fdadde666c370942547313a303f12ba107ca8ce8fd663b11a5

Databases: 32, row count: 142701, size: 7.9 MB
Found table A____Z____RECOVER____DATA.README with 1 records
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.engine_cost with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 50 records
Found table mysql.help_keyword with 877 records
Found table mysql.help_relation with 1872 records
Found table mysql.help_topic with 882 records
Found table mysql.innodb_index_stats with 10 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 48 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1532 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 2194 records
Found table mysql.time_zone_transition with 125689 records
Found table mysql.time_zone_transition_type with 9518 records
Found table mysql.user with 8 records

Found on 2024-11-01 00:13

7.9 MBytes 142701 rows

Severity: critical
Fingerprint: cf350410ecceb5fd6480f62dd6c7142baefe9da6051be844f1fafbc27ac4de6f

Databases: 32, row count: 142700, size: 7.9 MB
Found table A____Z____RECOVER____DATA.README with 1 records
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.engine_cost with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 50 records
Found table mysql.help_keyword with 877 records
Found table mysql.help_relation with 1872 records
Found table mysql.help_topic with 882 records
Found table mysql.innodb_index_stats with 10 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 48 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1532 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 2194 records
Found table mysql.time_zone_transition with 125689 records
Found table mysql.time_zone_transition_type with 9518 records
Found table mysql.user with 7 records

Found on 2024-05-28 23:07

7.9 MBytes 142700 rows

Severity: critical
Fingerprint: cf350410ecceb5fd6480f62dccc35070eedbf19fadeb93934304b5e97317ddf7

Databases: 32, row count: 142700, size: 7.9 MB
Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.engine_cost with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 50 records
Found table mysql.help_keyword with 877 records
Found table mysql.help_relation with 1872 records
Found table mysql.help_topic with 882 records
Found table mysql.innodb_index_stats with 10 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 48 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1532 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 2194 records
Found table mysql.time_zone_transition with 125689 records
Found table mysql.time_zone_transition_type with 9518 records
Found table mysql.user with 6 records

Found on 2023-10-03 14:09

7.9 MBytes 142700 rows

Severity: critical
Fingerprint: cf350410ecceb5fd2e433c1a9987078b24f8ec86be0e2fe4574b90e21218b5e7

Databases: 32, row count: 143797, size: 7.9 MB
Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.engine_cost with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 50 records
Found table mysql.help_keyword with 919 records
Found table mysql.help_relation with 1981 records
Found table mysql.help_topic with 721 records
Found table mysql.innodb_index_stats with 10 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 48 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1885 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 2605 records
Found table mysql.time_zone_transition with 125689 records
Found table mysql.time_zone_transition_type with 9862 records
Found table mysql.user with 5 records

Found on 2023-09-06 23:19

7.9 MBytes 143797 rows

Severity: high
Fingerprint: cf350410ecceb5fdebd6b7603a2aadba3a2aadba3a2aadba3a2aadba3a2aadba

Databases: 1, row count: 2, size: 16.4 kB
No or default MySQL authentication found.Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records

Found on 2023-08-24 06:30

16.4 kBytes 2 rows

Severity: critical
Fingerprint: cf350410ecceb5fd2e433c1a96261fc8fce6abe778b4038b0c17b2d18102ad3a

Databases: 32, row count: 143797, size: 7.9 MB
No or default MySQL authentication found.Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.engine_cost with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 50 records
Found table mysql.help_keyword with 919 records
Found table mysql.help_relation with 1981 records
Found table mysql.help_topic with 721 records
Found table mysql.innodb_index_stats with 10 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 48 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1885 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 2605 records
Found table mysql.time_zone_transition with 125689 records
Found table mysql.time_zone_transition_type with 9862 records
Found table mysql.user with 5 records

Found on 2023-08-05 03:57

7.9 MBytes 143797 rows

Severity: critical
Fingerprint: cf350410ecceb5fd8887d492d5102693b34c34de02cd6c8c35d549ba40298b37

Databases: 32, row count: 142224, size: 7.9 MB
Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.engine_cost with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 50 records
Found table mysql.help_keyword with 746 records
Found table mysql.help_relation with 1980 records
Found table mysql.help_topic with 603 records
Found table mysql.innodb_index_stats with 10 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 48 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1815 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 1103 records
Found table mysql.time_zone_transition with 125689 records
Found table mysql.time_zone_transition_type with 10153 records
Found table mysql.user with 5 records

Found on 2022-07-06 21:04

7.9 MBytes 142224 rows

Create report

Redis instance is public

The Redis instance is open to the public.

This could result to data leak and code execution.

IP: 120.26.194.8
Port: 6379

First seen 2023-05-17 18:46
Last seen 2023-12-23 19:50
Open for 220 days
- Severity: medium
  Fingerprint: d606b92f1b5fdf1897c596ab97c596ab97c596ab97c596ab97c596ab97c596ab
```
Redis is open with 4 keys in dbs
```
  Found on 2023-12-23 19:50
  
  4 rows
- Severity: medium
  Fingerprint: d606b92f1b5fdf18476e4752476e4752476e4752476e4752476e4752476e4752
```
Redis is open with 1 keys in dbs
```
  Found on 2023-11-16 16:50
  
  1 rows
- Severity: medium
  Fingerprint: d606b92f1b5fdf185732408f5732408f5732408f5732408f5732408f5732408f
```
Redis is open with 0 keys in dbs
```
  Found on 2023-09-07 00:16
Create report
ElasticSearch is publicly available

Elasticsearch and/or Kibana is currently open without authentication.

Additionaly a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 120.26.194.8
Port: 9200
URL: http://120.26.194.8:9200

First seen 2021-11-27 20:24
Last seen 2023-07-07 11:00
Open for 586 days
- Severity: high
  Fingerprint: 831cb76b8e05df4640f0fac6c20d1751c20d1751c20d1751c20d1751c20d1751
```
Indices: 1, document count: 1, size: 4.5 kB
Found index read_me with 1 documents (4.5 kB)
```
  Found on 2023-07-07 11:00
  
  4.5 kBytes 1 rows
- Severity: high
  Fingerprint: 831cb76b8e05df46f99e36e7d4075051d4075051d4075051d4075051d4075051
```
Indices: 1, document count: 1, size: 4.6 kB
Found index read_me with 1 documents (4.6 kB)
```
  Found on 2022-07-28 21:48
  
  4.6 kBytes 1 rows
- Severity: medium
  Fingerprint: 831cb76b8e05df46c87fb6fb40c00cf43d5d3d87b5d8f55fe36633ec84a9fa01
```
Indices: 5, document count: 7, size: 39.4 kB
Found index .kibana_task_manager_1 with 2 documents (16.0 kB)
Found index .apm-agent-configuration with 0 documents (283 B)
Found index .kibana_1 with 2 documents (11.6 kB)
Found index users with 1 documents (4.6 kB)
Found index customer with 2 documents (6.9 kB)
```
  Found on 2021-11-27 20:24
  
  39.4 kBytes 7 rows
Create report

Open service 120.26.194.8:3306

2024-11-01 00:13
```
MySQL detected
```
Found 2 hours ago by tcpid
Create report
Open service 120.26.194.8:3306

2024-10-30 01:30
```
MySQL detected
```
Found 2 days ago by tcpid
Create report
Open service 120.26.194.8:3306

2024-10-21 23:13
```
MySQL detected
```
Found 2024-10-21 by tcpid
Create report
Open service 120.26.194.8:3306

2024-10-19 23:42
```
MySQL detected
```
Found 2024-10-19 by tcpid
Create report
Open service 120.26.194.8:3306

2024-10-17 21:58
```
MySQL detected
```
Found 2024-10-17 by tcpid
Create report
Open service 120.26.194.8:3306

2024-10-15 21:41
```
MySQL detected
```
Found 2024-10-15 by tcpid
Create report
Open service 120.26.194.8:3306

2024-10-01 23:32
```
MySQL detected
```
Found 2024-10-01 by tcpid
Create report
Open service 120.26.194.8:3306

2024-09-29 23:18
```
MySQL detected
```
Found 2024-09-29 by tcpid
Create report
Open service 120.26.194.8:3306

2024-09-27 23:01
```
MySQL detected
```
Found 2024-09-27 by tcpid
Create report

Data leak

Size

7.9 MB

Collections

Rows

143797

Domain summary

No record

Host 120.26.194.8

China

MySQL is publicly available

Redis instance is public

ElasticSearch is publicly available

Data leak

Domain summary