LeakIX - Host 13.213.18.7

Host 13.213.18.7

Singapore

AMAZON-02

Linux x86_64

Software information

nginx nginx 1.18.0

tcp/443 tcp/80

MySQL is publicly available

MySQL is currently open without authentication.

Additionally a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 13.213.18.7
Port: 3306

First seen 2023-07-28 10:04
Last seen 2024-06-19 22:22
Open for 327 days

Severity: critical
Fingerprint: cf350410ecceb5fd939248c9624098146696ff431d61c46e01efd8dcc8e0960b

Databases: 34, row count: 140885, size: 7.7 MB
Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.component with 0 records
Found table mysql.db with 2 records
Found table mysql.default_roles with 0 records
Found table mysql.engine_cost with 2 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.global_grants with 59 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 44 records
Found table mysql.help_keyword with 798 records
Found table mysql.help_relation with 1837 records
Found table mysql.help_topic with 569 records
Found table mysql.innodb_index_stats with 13 records
Found table mysql.innodb_table_stats with 4 records
Found table mysql.password_history with 0 records
Found table mysql.plugin with 0 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.role_edges with 0 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 2074 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 1769 records
Found table mysql.time_zone_transition with 124807 records
Found table mysql.time_zone_transition_type with 8884 records
Found table mysql.user with 8 records

Found on 2024-06-19 22:22

7.7 MBytes 140885 rows

Severity: critical
Fingerprint: cf350410ecceb5fd939248c9c82963b1e8e0693c687b1ad576f86a7df9e87198

Databases: 34, row count: 140885, size: 7.7 MB
No or default MySQL authentication found.Found table Z_README_TO_RECOVER.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.component with 0 records
Found table mysql.db with 2 records
Found table mysql.default_roles with 0 records
Found table mysql.engine_cost with 2 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.global_grants with 59 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 44 records
Found table mysql.help_keyword with 798 records
Found table mysql.help_relation with 1837 records
Found table mysql.help_topic with 569 records
Found table mysql.innodb_index_stats with 13 records
Found table mysql.innodb_table_stats with 4 records
Found table mysql.password_history with 0 records
Found table mysql.plugin with 0 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.role_edges with 0 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 2074 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 1769 records
Found table mysql.time_zone_transition with 124807 records
Found table mysql.time_zone_transition_type with 8884 records
Found table mysql.user with 8 records

Found on 2023-07-28 10:04

7.7 MBytes 140885 rows

Create report

Open service 13.213.18.7:3306

2024-06-19 22:22
```
MySQL detected
```
Found 13 hours ago by tcpid
Create report
Open service 13.213.18.7:3306

2024-06-17 21:59
```
MySQL detected
```
Found 3 days ago by tcpid
Create report
Open service 13.213.18.7:3306

2024-06-15 23:24
```
MySQL detected
```
Found 2024-06-15 by tcpid
Create report

Open service 13.213.18.7:443

2024-06-15 16:12

HTTP/1.1 502 Bad Gateway
Server: nginx/1.18.0 (Ubuntu)
Date: Sat, 15 Jun 2024 16:12:13 GMT
Content-Type: text/html
Content-Length: 568
Connection: close

Page title: 502 Bad Gateway

<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.18.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->

Found 2024-06-15 by HttpPlugin

Create report

Open service 13.213.18.7:3306

2024-06-15 01:17
```
MySQL detected
```
Found 2024-06-15 by tcpid
Create report

Open service 13.213.18.7:443 · cdc-nextblock.vinova.sg

2024-06-13 23:36

HTTP/1.1 502 Bad Gateway
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 13 Jun 2024 23:36:00 GMT
Content-Type: text/html
Content-Length: 568
Connection: close

Page title: 502 Bad Gateway

<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.18.0 (Ubuntu)</center>
</body>
</html>
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->

Found 2024-06-13 by HttpPlugin

Create report

Open service 13.213.18.7:80 · cdc-nextblock.vinova.sg

2024-06-13 23:36

HTTP/1.1 301 Moved Permanently
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 13 Jun 2024 23:36:01 GMT
Content-Type: text/html
Content-Length: 178
Connection: close
Location: https://cdc-nextblock.vinova.sg/

Page title: 301 Moved Permanently

<html>
<head><title>301 Moved Permanently</title></head>
<body>
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.18.0 (Ubuntu)</center>
</body>
</html>

Found 2024-06-13 by HttpPlugin

Create report

Open service 13.213.18.7:3306

2024-06-11 22:19
```
MySQL detected
```
Found 2024-06-11 by tcpid
Create report
Open service 13.213.18.7:3306

2024-06-09 20:32
```
MySQL detected
```
Found 2024-06-09 by tcpid
Create report
Open service 13.213.18.7:3306

2024-06-03 21:57
```
MySQL detected
```
Found 2024-06-03 by tcpid
Create report

cdc-nextblock.vinova.sg

Fingerprint:

e6a9a51968e836485213b1d3c668af4136f29e62e95090bcce73ef6abf435d93

CN:

cdc-nextblock.vinova.sg

Key:

RSA-2048

Issuer:

R10

Not before:

2024-06-13 22:34

Not after:

2024-09-11 22:34

Data leak

Size

7.7 MB

Collections

Rows

140885

Domain summary

cdc-nextblock.vinova.sg 1

1 recorded