LeakIX - Host 14.225.29.91

Host 14.225.29.91

Vietnam

VIETNAM POSTS AND TELECOMMUNICATIONS GROUP

Linux x86_64

Software information

nginx nginx 1.14.1

tcp/443 tcp/80

MySQL is publicly available

MySQL is currently open without authentication.

Additionally a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 14.225.29.91
Port: 3306

First seen 2024-04-23 07:30

Severity: critical
Fingerprint: cf350410ecceb5fdb7288494c4d63a8e396e5de0aab9c5cb1701fd9228f882ed

Databases: 48, row count: 138472, size: 8.1 MB
Found table RECOVER_YOUR_DATA.RECOVER_YOUR_DATA with 2 records
Found table bootdb.flyway_schema_history with 1 records
Found table bootdb.lading_bill with 0 records
Found table bootdb.procedure_bill with 0 records
Found table bootdb.procedures with 2 records
Found table bootdb.roles with 2 records
Found table bootdb.shop with 3 records
Found table bootdb.shop_user with 5 records
Found table bootdb.user_roles with 8 records
Found table bootdb.users with 8 records
Found table mysql.columns_priv with 0 records
Found table mysql.component with 0 records
Found table mysql.db with 2 records
Found table mysql.default_roles with 0 records
Found table mysql.engine_cost with 2 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.global_grants with 75 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 53 records
Found table mysql.help_keyword with 878 records
Found table mysql.help_relation with 3199 records
Found table mysql.help_topic with 431 records
Found table mysql.innodb_index_stats with 86 records
Found table mysql.innodb_table_stats with 12 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.password_history with 0 records
Found table mysql.plugin with 0 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.replication_asynchronous_connection_failover with 0 records
Found table mysql.replication_asynchronous_connection_failover_managed with 0 records
Found table mysql.replication_group_configuration_version with 1 records
Found table mysql.replication_group_member_actions with 2 records
Found table mysql.role_edges with 0 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 1826 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 1350 records
Found table mysql.time_zone_transition with 122161 records
Found table mysql.time_zone_transition_type with 8345 records
Found table mysql.user with 5 records

Found on 2024-04-23 07:30

8.1 MBytes 138472 rows

Create report

Open service 14.225.29.91:3306

2024-06-19 21:22
```
MySQL detected
```
Found 14 hours ago by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-17 20:53
```
MySQL detected
```
Found 3 days ago by tcpid
Create report

Open service 14.225.29.91:8080

2024-06-15 23:31

HTTP/1.1 200 
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Last-Modified: Thu, 13 Jun 2024 03:08:41 GMT
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 523
Date: Sat, 15 Jun 2024 23:33:35 GMT
Connection: close

Page title: Frontend

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>Frontend</title>
    <base href="/">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="icon" type="image/x-icon" href="favicon.ico">
    <link rel="stylesheet" href="/client/styles.css">
</head>
<body>
<app-root></app-root>
<script src="client/runtime.js" type="module"></script>
<script src="client/polyfills.js" type="module"></script>
<script src="client/main.js" type="module"></script>

</body>
</html>

Found 2024-06-15 by HttpPlugin

Create report

Open service 14.225.29.91:3306

2024-06-15 21:48
```
MySQL detected
```
Found 2024-06-15 by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-15 15:57
```
MySQL detected
```
Found 2024-06-15 by tcpid
Create report

Open service 14.225.29.91:443

2024-06-15 09:59

HTTP/1.1 200 
Server: nginx/1.14.1
Date: Sat, 15 Jun 2024 10:00:56 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 523
Connection: close
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Last-Modified: Thu, 13 Jun 2024 03:08:41 GMT
Accept-Ranges: bytes
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Frame-Options: DENY
Content-Language: en

Page title: Frontend

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8">
    <title>Frontend</title>
    <base href="/">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="icon" type="image/x-icon" href="favicon.ico">
    <link rel="stylesheet" href="/client/styles.css">
</head>
<body>
<app-root></app-root>
<script src="client/runtime.js" type="module"></script>
<script src="client/polyfills.js" type="module"></script>
<script src="client/main.js" type="module"></script>

</body>
</html>

Found 2024-06-15 by HttpPlugin

Create report

Open service 14.225.29.91:3306

2024-06-11 20:45
```
MySQL detected
```
Found 2024-06-11 by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-09 21:01
```
MySQL detected
```
Found 2024-06-09 by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-07 20:47
```
MySQL detected
```
Found 2024-06-07 by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-05 20:58
```
MySQL detected
```
Found 2024-06-05 by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-03 21:18
```
MySQL detected
```
Found 2024-06-03 by tcpid
Create report
Open service 14.225.29.91:3306

2024-06-02 13:43
```
MySQL detected
```
Found 2024-06-02 by tcpid
Create report

Open service 14.225.29.91:80

2024-06-02 13:22

HTTP/1.1 200 OK
Server: nginx/1.14.1
Date: Sun, 02 Jun 2024 13:24:13 GMT
Content-Type: text/html
Content-Length: 4057
Last-Modified: Tue, 21 Dec 2021 19:41:19 GMT
Connection: close
ETag: "61c22ddf-fd9"
Accept-Ranges: bytes

Page title: Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
    <head>
        <title>Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux</title>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
        <style type="text/css">
            /*<![CDATA[*/
            body {
                background-color: #fff;
                color: #000;
                font-size: 0.9em;
                font-family: sans-serif,helvetica;
                margin: 0;
                padding: 0;
            }
            :link {
                color: #c00;
            }
            :visited {
                color: #c00;
            }
            a:hover {
                color: #f50;
            }
            h1 {
                text-align: center;
                margin: 0;
                padding: 0.6em 2em 0.4em;
                background-color: #900;
                color: #fff;
                font-weight: normal;
                font-size: 1.75em;
                border-bottom: 2px solid #000;
            }
            h1 strong {
                font-weight: bold;
                font-size: 1.5em;
            }
            h2 {
                text-align: center;
                background-color: #900;
                font-size: 1.1em;
                font-weight: bold;
                color: #fff;
                margin: 0;
                padding: 0.5em;
                border-bottom: 2px solid #000;
            }
            hr {
                display: none;
            }
            .content {
                padding: 1em 5em;
            }
            .alert {
                border: 2px solid #000;
            }

            img {
                border: 2px solid #fff;
                padding: 2px;
                margin: 2px;
            }
            a:hover img {
                border: 2px solid #294172;
            }
            .logos {
                margin: 1em;
                text-align: center;
            }
            /*]]>*/
        </style>
    </head>

    <body>
        <h1>Welcome to <strong>nginx</strong> on Red Hat Enterprise Linux!</h1>

        <div class="content">
            <p>This page is used to test the proper operation of the
            <strong>nginx</strong> HTTP server after it has been
            installed. If you can read this page, it means that the
            web server installed at this site is working
            properly.</p>

            <div class="alert">
                <h2>Website Administrator</h2>
                <div class="content">
                    <p>This is the default <tt>index.html</tt> page that
                    is distributed with <strong>nginx</strong> on
                    Red Hat Enterprise Linux.  It is located in
                    <tt>/usr/share/nginx/html</tt>.</p>

                    <p>You should now put your content in a location of
                    your choice and edit the <tt>root</tt> configuration
                    directive in the <strong>nginx</strong>
                    configuration file
                    <tt>/etc/nginx/nginx.conf</tt>.</p>

                    <p>For information on Red Hat Enterprise Linux, please visit the <a href="http://www.redhat.com/">Red Hat, Inc. website</a>. The documentation for Red Hat Enterprise Linux is <a href="http://www.redhat.com/docs/manuals/enterprise/">available on the Red Hat, Inc. website</a>.</p>

                </div>
            </div>

            <div class="logos">
                <a href="http://nginx.net/"><img
                    src="nginx-logo.png" 
                    alt="[ Powered by nginx ]"
                    width="121" height="32" /></a>
                <a href="http://www.redhat.com/"><img
                    src="poweredby.png"
                    alt="[ Powered by Red Hat Enterprise Linux ]"
                    width="88" height="31" /></a>
            </div>
        </div>
    </body>
</html>

Found 2024-06-02 by HttpPlugin

Create report

Open service 14.225.29.91:22

2024-06-02 11:08
Found 2024-06-02 by SSHOpenPlugin
Create report

simplereply.congdongcode.vn

Fingerprint:

2285985d3dade9f1229b6e80063676bf7ca5b251a6f15e955a274e4ea22c7532

CN:

simplereply.congdongcode.vn

Key:

RSA-2048

Issuer:

Not before:

2024-04-26 05:51

Not after:

2024-07-25 05:51

Data leak

Size

8.1 MB

Collections

Rows

138472

Domain summary

No record