LeakIX - Host 194.163.143.71

Host 194.163.143.71

Germany

Contabo GmbH

CentOS Linux 7 (Core) 5.4.0-146-generic

Software information

Apache Apache 2.4.41

tcp/443 tcp/80

Elasticsearch 7.9.1

tcp/9200

MiniServ 2.021

tcp/10000

ElasticSearch is publicly available

Elasticsearch and/or Kibana is currently open without authentication.

Additionaly a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 194.163.143.71
Port: 9200
URL: http://194.163.143.71:9200

First seen 2023-08-19 12:27
Last seen 2024-09-27 21:58
Open for 405 days
- Severity: medium
  Fingerprint: 831cb76b8e05df4630d74e0d5b021041e5018802e5018802e5018802e5018802
```
Indices: 2, document count: 2, size: 10.9 kB
Found index internal with 1 documents (6.6 kB)
Found index read-me-to-recover-data with 1 documents (4.3 kB)
```
  Found on 2024-09-27 21:58
  
  10.9 kBytes 2 rows
- Severity: medium
  Fingerprint: 831cb76b8e05df46cae9690cc3e53059c3e53059c3e53059c3e53059c3e53059
```
Indices: 1, document count: 1, size: 4.3 kB
Found index read-me-to-recover-data with 1 documents (4.3 kB)
```
  Found on 2024-07-07 21:34
  
  4.3 kBytes 1 rows
- Severity: high
  Fingerprint: 831cb76b8e05df4634a5f57b883d426690187c2c90187c2c90187c2c90187c2c
```
Indices: 2, document count: 2, size: 11.2 kB
Found index read-me with 1 documents (4.3 kB)
Found index .kibana_1 with 1 documents (7.0 kB)
```
  Found on 2024-02-01 18:43
  
  11.2 kBytes 2 rows
- Severity: medium
  Fingerprint: 831cb76b8e05df46cae9690c3966348839663488396634883966348839663488
```
Indices: 1, document count: 1, size: 4.3 kB
Found index read_me_to_restore_base with 1 documents (4.3 kB)
```
  Found on 2023-11-24 22:34
  
  4.3 kBytes 1 rows
- Severity: high
  Fingerprint: 831cb76b8e05df46fc4be251841e48e49318a6ef9318a6ef9318a6ef9318a6ef
```
Indices: 2, document count: 2, size: 8.2 kB
Found index test with 1 documents (3.9 kB)
Found index read-me with 1 documents (4.3 kB)
```
  Found on 2023-11-05 20:30
  
  8.2 kBytes 2 rows
- Severity: high
  Fingerprint: 831cb76b8e05df46cae9690c22b984c722b984c722b984c722b984c722b984c7
```
Indices: 1, document count: 1, size: 4.3 kB
Found index read-me with 1 documents (4.3 kB)
```
  Found on 2023-10-10 23:08
  
  4.3 kBytes 1 rows
- Severity: high
  Fingerprint: 831cb76b8e05df4640f0fac62a5019532a5019532a5019532a5019532a501953
```
Indices: 1, document count: 1, size: 4.5 kB
Found index read-me with 1 documents (4.5 kB)
```
  Found on 2023-08-19 12:27
  
  4.5 kBytes 1 rows
Create report

Found php information file

PHPinfo page has been found in this directory. The PHPinfo page outputs a large amount of information about the current state of PHP.

This includes information about PHP compilation options and extensions, the PHP version, server information and environment (if compiled as a module), the PHP environment, OS version information, paths, master and local values of configuration options, HTTP headers, and the PHP License.

Environment variables may contain credentials.

https://www.acunetix.com/vulnerabilities/web/phpinfo-page/

IP: 194.163.143.71
Port: 80
URL: http://194.163.143.71/info.php

First seen 2022-07-25 20:18
Last seen 2022-08-07 20:55
Open for 13 days

Fingerprint: 2c44e2a6278fb0134173d6fabcd1a58c04e0f1820753f76ff12789551566ad31

Found PHP info page:
$_SERVER['USER'] = www-data
$_SERVER['HOME'] = /var/www
$_SERVER['SCRIPT_NAME'] = /info.php
$_SERVER['REQUEST_URI'] = /info.php
$_SERVER['QUERY_STRING'] = no value
$_SERVER['REQUEST_METHOD'] = GET
$_SERVER['SERVER_PROTOCOL'] = HTTP/1.1
$_SERVER['GATEWAY_INTERFACE'] = CGI/1.1
$_SERVER['REMOTE_PORT'] = 53260
$_SERVER['SCRIPT_FILENAME'] = /var/www/html/info.php
$_SERVER['SERVER_ADMIN'] = [no address given]
$_SERVER['CONTEXT_DOCUMENT_ROOT'] = /var/www/html
$_SERVER['CONTEXT_PREFIX'] = no value
$_SERVER['REQUEST_SCHEME'] = http
$_SERVER['DOCUMENT_ROOT'] = /var/www/html
$_SERVER['REMOTE_ADDR'] = 161.35.86.181
$_SERVER['SERVER_PORT'] = 80
$_SERVER['SERVER_ADDR'] = 194.163.143.71
$_SERVER['SERVER_NAME'] = 194.163.143.71
$_SERVER['SERVER_SOFTWARE'] = Apache/2.4.41 (Ubuntu)
$_SERVER['SERVER_SIGNATURE'] = <address>Apache/2.4.41 (Ubuntu) Server at 194.163.143.71 Port 80</address>
$_SERVER['PATH'] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
$_SERVER['HTTP_CONNECTION'] = close
$_SERVER['HTTP_ACCEPT_ENCODING'] = gzip
$_SERVER['HTTP_USER_AGENT'] = l9explore/1.3.0
$_SERVER['HTTP_HOST'] = 194.163.143.71
$_SERVER['proxy-nokeepalive'] = 1
$_SERVER['FCGI_ROLE'] = RESPONDER
$_SERVER['PHP_SELF'] = /info.php
$_SERVER['REQUEST_TIME_FLOAT'] = 1659905755.0639
$_SERVER['REQUEST_TIME'] = 1659905755

Found on 2022-08-07 20:55

Fingerprint: 2c44e2a6278fb0134173d6fabcd1a58c04e0f1820753f76ff12789557f4c1f3f

Found PHP info page:
$_SERVER['USER'] = www-data
$_SERVER['HOME'] = /var/www
$_SERVER['SCRIPT_NAME'] = /info.php
$_SERVER['REQUEST_URI'] = /info.php
$_SERVER['QUERY_STRING'] = no value
$_SERVER['REQUEST_METHOD'] = GET
$_SERVER['SERVER_PROTOCOL'] = HTTP/1.1
$_SERVER['GATEWAY_INTERFACE'] = CGI/1.1
$_SERVER['REMOTE_PORT'] = 57408
$_SERVER['SCRIPT_FILENAME'] = /var/www/html/info.php
$_SERVER['SERVER_ADMIN'] = [no address given]
$_SERVER['CONTEXT_DOCUMENT_ROOT'] = /var/www/html
$_SERVER['CONTEXT_PREFIX'] = no value
$_SERVER['REQUEST_SCHEME'] = http
$_SERVER['DOCUMENT_ROOT'] = /var/www/html
$_SERVER['REMOTE_ADDR'] = 161.35.86.181
$_SERVER['SERVER_PORT'] = 80
$_SERVER['SERVER_ADDR'] = 194.163.143.71
$_SERVER['SERVER_NAME'] = 194.163.143.71
$_SERVER['SERVER_SOFTWARE'] = Apache/2.4.41 (Ubuntu)
$_SERVER['SERVER_SIGNATURE'] = <address>Apache/2.4.41 (Ubuntu) Server at 194.163.143.71 Port 80</address>
$_SERVER['PATH'] = /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
$_SERVER['HTTP_CONNECTION'] = close
$_SERVER['HTTP_ACCEPT_ENCODING'] = gzip
$_SERVER['HTTP_USER_AGENT'] = l9explore/1.3.0
$_SERVER['HTTP_HOST'] = 194.163.143.71
$_SERVER['proxy-nokeepalive'] = 1
$_SERVER['FCGI_ROLE'] = RESPONDER
$_SERVER['PHP_SELF'] = /info.php
$_SERVER['REQUEST_TIME_FLOAT'] = 1658780318.394
$_SERVER['REQUEST_TIME'] = 1658780318

Found on 2022-07-25 20:18

Create report

Open service 194.163.143.71:9200

2024-09-27 21:58

HTTP/1.1 200 OK
content-type: application/json; charset=UTF-8
content-length: 541


{
  "name" : "6aecf287deb6",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "lg1SbbZ7QS-WMkwGOq8B7Q",
  "version" : {
    "number" : "7.9.1",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "083627f112ba94dffc1232e8b42b73492789ef91",
    "build_date" : "2020-09-01T21:22:21.964974Z",
    "build_snapshot" : false,
    "lucene_version" : "8.6.2",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Found 8 hours ago by HttpPlugin

Host 194.163.143.71

Germany

Software information

ElasticSearch is publicly available

Found php information file

ecommerce-orce.com

Data leak

Domain summary