LeakIX - Host 47.113.145.229

Host 47.113.145.229

China

Hangzhou Alibaba Advertising Co.,Ltd.

Linux 5.15.0-71-generic x86_64

MySQL is publicly available

MySQL is currently open without authentication.

Additionally a ransom note has been found in the dataset which indicates it has been compromised

This results in all the database data made available publicly.

IP: 47.113.145.229
Port: 3306

First seen 2024-02-20 06:21
Last seen 2024-06-19 20:49
Open for 120 days

Severity: critical
Fingerprint: cf350410ecceb5fd81129489f2ee1525b7701260e0b3cd610f284a49fedda0f4

Databases: 38, row count: 4215, size: 2.4 MB
Found table README_TO_RECOVER_A.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.component with 0 records
Found table mysql.db with 2 records
Found table mysql.default_roles with 0 records
Found table mysql.engine_cost with 2 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.global_grants with 125 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 53 records
Found table mysql.help_keyword with 1092 records
Found table mysql.help_relation with 2191 records
Found table mysql.help_topic with 714 records
Found table mysql.innodb_index_stats with 9 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.password_history with 0 records
Found table mysql.plugin with 1 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.replication_asynchronous_connection_failover with 0 records
Found table mysql.replication_asynchronous_connection_failover_managed with 0 records
Found table mysql.replication_group_configuration_version with 1 records
Found table mysql.replication_group_member_actions with 2 records
Found table mysql.role_edges with 0 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 0 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 0 records
Found table mysql.time_zone_transition with 0 records
Found table mysql.time_zone_transition_type with 0 records
Found table mysql.user with 5 records

Found on 2024-06-19 20:49

2.4 MBytes 4215 rows

Severity: critical
Fingerprint: cf350410ecceb5fdea474bf58c372a6964ddece488e3b8ed72f47b65ac3a9709

Databases: 38, row count: 4516, size: 2.4 MB
Found table README_TO_RECOVER_A.RECOVER_YOUR_DATA with 2 records
Found table mysql.columns_priv with 0 records
Found table mysql.component with 0 records
Found table mysql.db with 2 records
Found table mysql.default_roles with 0 records
Found table mysql.engine_cost with 2 records
Found table mysql.func with 0 records
Found table mysql.general_log with 2 records
Found table mysql.global_grants with 146 records
Found table mysql.gtid_executed with 0 records
Found table mysql.help_category with 53 records
Found table mysql.help_keyword with 939 records
Found table mysql.help_relation with 2636 records
Found table mysql.help_topic with 702 records
Found table mysql.innodb_index_stats with 9 records
Found table mysql.innodb_table_stats with 3 records
Found table mysql.password_history with 0 records
Found table mysql.plugin with 1 records
Found table mysql.procs_priv with 0 records
Found table mysql.proxies_priv with 1 records
Found table mysql.replication_asynchronous_connection_failover with 0 records
Found table mysql.replication_asynchronous_connection_failover_managed with 0 records
Found table mysql.replication_group_configuration_version with 1 records
Found table mysql.replication_group_member_actions with 2 records
Found table mysql.role_edges with 0 records
Found table mysql.server_cost with 6 records
Found table mysql.servers with 0 records
Found table mysql.slave_master_info with 0 records
Found table mysql.slave_relay_log_info with 0 records
Found table mysql.slave_worker_info with 0 records
Found table mysql.slow_log with 2 records
Found table mysql.tables_priv with 2 records
Found table mysql.time_zone with 0 records
Found table mysql.time_zone_leap_second with 0 records
Found table mysql.time_zone_name with 0 records
Found table mysql.time_zone_transition with 0 records
Found table mysql.time_zone_transition_type with 0 records
Found table mysql.user with 5 records

Found on 2024-06-11 19:58

2.4 MBytes 4516 rows

Create report

Redis instance is public

The Redis instance is open to the public.

This could result to data leak and code execution.

IP: 47.113.145.229
Port: 6379

First seen 2024-02-15 04:41
Last seen 2024-02-17 01:43
Open for 1 days
- Severity: medium
  Fingerprint: d606b92f1b5fdf1897c596ab97c596ab97c596ab97c596ab97c596ab97c596ab
```
Redis is open with 4 keys in dbs
```
  Found on 2024-02-17 01:43
  
  4 rows
Create report

Open service 47.113.145.229:3306

2024-06-19 20:49
```
MySQL detected
```
Found 15 hours ago by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-17 20:02
```
MySQL detected
```
Found 3 days ago by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-15 20:43
```
MySQL detected
```
Found 2024-06-15 by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-13 15:41
```
MySQL detected
```
Found 2024-06-13 by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-11 19:58
```
MySQL detected
```
Found 2024-06-11 by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-09 20:13
```
MySQL detected
```
Found 2024-06-09 by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-07 19:59
```
MySQL detected
```
Found 2024-06-07 by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-05 20:12
```
MySQL detected
```
Found 2024-06-05 by tcpid
Create report
Open service 47.113.145.229:3306

2024-06-03 20:01
```
MySQL detected
```
Found 2024-06-03 by tcpid
Create report

Open service 47.113.145.229:80

2024-06-02 18:36

HTTP/1.1 200 
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Date: Sun, 02 Jun 2024 18:36:36 GMT
Connection: close

Page title: Apache Tomcat/9.0.35




<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="UTF-8" />
        <title>Apache Tomcat/9.0.35</title>
        <link href="favicon.ico" rel="icon" type="image/x-icon" />
        <link href="favicon.ico" rel="shortcut icon" type="image/x-icon" />
        <link href="tomcat.css" rel="stylesheet" type="text/css" />
    </head>

    <body>
        <div id="wrapper">
            <div id="navigation" class="curved container">
                <span id="nav-home"><a href="https://tomcat.apache.org/">Home</a></span>
                <span id="nav-hosts"><a href="/docs/">Documentation</a></span>
                <span id="nav-config"><a href="/docs/config/">Configuration</a></span>
                <span id="nav-examples"><a href="/examples/">Examples</a></span>
                <span id="nav-wiki"><a href="https://wiki.apache.org/tomcat/FrontPage">Wiki</a></span>
                <span id="nav-lists"><a href="https://tomcat.apache.org/lists.html">Mailing Lists</a></span>
                <span id="nav-help"><a href="https://tomcat.apache.org/findhelp.html">Find Help</a></span>
                <br class="separator" />
            </div>
            <div id="asf-box">
                <h1>Apache Tomcat/9.0.35</h1>
            </div>
            <div id="upper" class="curved container">
                <div id="congrats" class="curved container">
                    <h2>If you're seeing this, you've successfully installed Tomcat. Congratulations!</h2>
                </div>
                <div id="notice">
                    <img src="tomcat.png" alt="[tomcat logo]" />
                    <div id="tasks">
                        <h3>Recommended Reading:</h3>
                        <h4><a href="/docs/security-howto.html">Security Considerations How-To</a></h4>
                        <h4><a href="/docs/manager-howto.html">Manager Application How-To</a></h4>
                        <h4><a href="/docs/cluster-howto.html">Clustering/Session Replication How-To</a></h4>
                    </div>
                </div>
                <div id="actions">
                    <div class="button">
                        <a class="container shadow" href="/manager/status"><span>Server Status</span></a>
                    </div>
                    <div class="button">
                        <a class="container shadow" href="/manager/html"><span>Manager App</span></a>
                    </div>
                    <div class="button">
                        <a class="container shadow" href="/host-manager/html"><span>Host Manager</span></a>
                    </div>
                </div>
                <br class="separator" />
            </div>
            <div id="middle" class="curved container">
                <h3>Developer Quick Start</h3>
                <div class="col25">
                    <div class="container">
                        <p><a href="/docs/setup.html">Tomcat Setup</a></p>
                        <p><a href="/docs/appdev/">First Web Application</a></p>
                    </div>
                </div>
                <div class="col25">
                    <div class="container">
                        <p><a href="/docs/realm-howto.html">Realms &amp; AAA</a></p>
                        <p><a href="/docs/jndi-datasource-examples-howto.html">JDBC DataSources</a></p>
                    </div>
                </div>
                <div class="col25">
                    <div class="container">
                        <p><a href="/examples/">Examples</a></p>
                    </div>
                </div>
                <div class="col25">
                    <div class="container">
                        <p><a href="https://wiki.apache.org/tomcat/Specifications">Servlet Specifications</a></p>
                        <p><a href="https://wiki.apache.org/tomcat/TomcatVersions">Tomcat Versions</a></p>
                    </div>
                </div>
                <br class="separator" />
            </div>
            <div id="lower">
                <div id="low-manage" class="">

Found 2024-06-02 by HttpPlugin

Create report

Data leak

Size

2.4 MB

Collections

Rows

4516

Domain summary

No record

Host 47.113.145.229

China

MySQL is publicly available

Redis instance is public

Data leak

Domain summary