LeakIX - Host 39.108.212.239

Host 39.108.212.239

China

Hangzhou Alibaba Advertising Co.,Ltd.

Win64 x86_64

Software information

Microsoft-IIS 7.5

tcp/8004

MySQL is publicly available

MySQL is currently open without authentication.

Additionally a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 39.108.212.239
Port: 3307

First seen 2023-09-18 04:28
Last seen 2024-11-12 00:14
Open for 420 days

Severity: high
Fingerprint: cf350410ecceb5fdf63f4394980131c3c8585947870516a5cd8fc07b1f3baf75

Databases: 33, row count: 2183, size: 783.0 kB
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.help_category with 40 records
Found table mysql.help_keyword with 485 records
Found table mysql.help_relation with 1090 records
Found table mysql.help_topic with 533 records
Found table mysql.innodb_index_stats with 18 records
Found table mysql.innodb_table_stats with 6 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.nlfxtf with 0 records
Found table mysql.nnhzlr with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 0 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 0 records
Found table mysql.time_zone with 0 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 0 records
Found table mysql.time_zone_transition with 0 records
Found table mysql.time_zone_transition_type with 0 records
Found table mysql.user with 4 records
Found table mysql.vvvnnt with 0 records
Found table mysql.xplrnh with 0 records
Found table mysql.zxlxxb with 0 records

Found on 2024-11-12 00:14

783.0 kBytes 2183 rows

Severity: critical
Fingerprint: cf350410ecceb5fd524b86640d6ea293f94a4357ede69e55681dfa4bb3f58bb8

Databases: 34, row count: 2185, size: 799.4 kB
Found table mysql.columns_priv with 0 records
Found table mysql.db with 2 records
Found table mysql.event with 0 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.help_category with 40 records
Found table mysql.help_keyword with 485 records
Found table mysql.help_relation with 1090 records
Found table mysql.help_topic with 533 records
Found table mysql.innodb_index_stats with 18 records
Found table mysql.innodb_table_stats with 6 records
Found table mysql.ndb_binlog_index with 0 records
Found table mysql.nlfxtf with 0 records
Found table mysql.nnhzlr with 0 records
Found table mysql.plugin with 0 records
Found table mysql.proc with 0 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 0 records
Found table mysql.time_zone with 0 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 0 records
Found table mysql.time_zone_transition with 0 records
Found table mysql.time_zone_transition_type with 0 records
Found table mysql.user with 4 records
Found table mysql.vvvnnt with 0 records
Found table mysql.xplrnh with 0 records
Found table mysql.zxlxxb with 0 records
Found table z_readme_to_recover.recover_your_data with 2 records

Found on 2024-02-01 17:49

799.4 kBytes 2185 rows

Create report

Open service 39.108.212.239:3307

2024-11-02 02:40
```
MySQL detected
```
Found 2024-11-02 by tcpid
Create report
Open service 39.108.212.239:3307

2024-11-01 00:44
```
MySQL detected
```
Found 2024-11-01 by tcpid
Create report
Open service 39.108.212.239:3307

2024-10-30 00:48
```
MySQL detected
```
Found 2024-10-30 by tcpid
Create report

Open service 39.108.212.239:8004

2024-10-28 21:56

HTTP/1.1 500 Internal Server Error
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/7.5
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Date: Mon, 28 Oct 2024 21:56:38 GMT
Connection: close
Content-Length: 3297

Page title: 运行时错误

<!DOCTYPE html>
<html>
    <head>
        <title>运行时错误</title>
        <meta name="viewport" content="width=device-width" />
        <style>
         body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;} 
         p {font-family:"Verdana";font-weight:normal;color:black;margin-top: -5px}
         b {font-family:"Verdana";font-weight:bold;color:black;margin-top: -5px}
         H1 { font-family:"Verdana";font-weight:normal;font-size:18pt;color:red }
         H2 { font-family:"Verdana";font-weight:normal;font-size:14pt;color:maroon }
         pre {font-family:"Consolas","Lucida Console",Monospace;font-size:11pt;margin:0;padding:0.5em;line-height:14pt}
         .marker {font-weight: bold; color: black;text-decoration: none;}
         .version {color: gray;}
         .error {margin-bottom: 10px;}
         .expandable { text-decoration:underline; font-weight:bold; color:navy; cursor:hand; }
         @media screen and (max-width: 639px) {
          pre { width: 440px; overflow: auto; white-space: pre-wrap; word-wrap: break-word; }
         }
         @media screen and (max-width: 479px) {
          pre { width: 280px; }
         }
        </style>
    </head>

    <body bgcolor="white">

            <span><H1>“/”应用程序中的服务器错误。<hr width=100% size=1 color=silver></H1>

            <h2> <i>运行时错误</i> </h2></span>

            <font face="Arial, Helvetica, Geneva, SunSans-Regular, sans-serif ">

            <b> 说明: </b>服务器上出现应用程序错误。此应用程序的当前自定义错误设置禁止远程查看应用程序错误的详细信息(出于安全原因)。但可以通过在本地服务器计算机上运行的浏览器查看。
            <br><br>

            <b>详细信息:</b> 若要使他人能够在远程计算机上查看此特定错误消息的详细信息，请在位于当前 Web 应用程序根目录下的“web.config”配置文件中创建一个 &lt;customErrors&gt; 标记。然后应将此 &lt;customErrors&gt; 标记的“mode”特性设置为“Off”。<br><br>

            <table width=100% bgcolor="#ffffcc">
               <tr>
                  <td>
                      <code><pre>

&lt;!-- Web.Config 配置文件 --&gt;

&lt;configuration&gt;
    &lt;system.web&gt;
        &lt;customErrors mode=&quot;Off&quot;/&gt;
    &lt;/system.web&gt;
&lt;/configuration&gt;</pre></code>

                  </td>
               </tr>
            </table>

            <br>

            <b>注释:</b> 通过修改应用程序的 &lt;customErrors&gt; 配置标记的“defaultRedirect”特性，使之指向自定义错误页的 URL，可以用自定义错误页替换所看到的当前错误页。<br><br>

            <table width=100% bgcolor="#ffffcc">
               <tr>
                  <td>
                      <code><pre>

&lt;!-- Web.Config 配置文件 --&gt;

&lt;configuration&gt;
    &lt;system.web&gt;
        &lt;customErrors mode=&quot;RemoteOnly&quot; defaultRedirect=&quot;mycustompage.htm&quot;/&gt;
    &lt;/system.web&gt;
&lt;/configuration&gt;</pre></code>

                  </td>
               </tr>
            </table>

            <br>

    </body>
</html>

Found 2024-10-28 by HttpPlugin

Create report

Open service 39.108.212.239:3307

2024-10-21 21:16
```
MySQL detected
```
Found 2024-10-21 by tcpid
Create report
Open service 39.108.212.239:3307

2024-10-19 22:29
```
MySQL detected
```
Found 2024-10-19 by tcpid
Create report
Open service 39.108.212.239:3307

2024-10-17 20:01
```
MySQL detected
```
Found 2024-10-17 by tcpid
Create report
Open service 39.108.212.239:3307

2024-10-16 01:06
```
MySQL detected
```
Found 2024-10-16 by tcpid
Create report
Open service 39.108.212.239:3307

2024-10-01 22:19
```
MySQL detected
```
Found 2024-10-01 by tcpid
Create report
Open service 39.108.212.239:3307

2024-09-29 22:21
```
MySQL detected
```
Found 2024-09-29 by tcpid
Create report
Open service 39.108.212.239:3307

2024-09-27 23:01
```
MySQL detected
```
Found 2024-09-27 by tcpid
Create report

Data leak

Size

799.4 kB

Collections

Rows

2185

Domain summary

No record