Exposed Data-Stores Radar
We continuously scan the public internet for databases — MongoDB, Elasticsearch, Redis, CouchDB, Memcached, Kibana and more — that are open with no password. No exploit is needed: anyone who finds one can read, copy, or delete everything in it. We detect these passively from Shodan’s public banner data — we never connect to them.
PII/PCI likelihood is inferred from schema only — exposed index/table/field names such as ssn, passport_number, or cardholder. We never read, store, or display the underlying records.
Why this is a risk
An open, unauthenticated database is an open door — not a vulnerability that needs an exploit, just data sitting exposed:
- • Anyone can read, copy, or delete the data — customers, criminals, or automated bots.
- • Ransomware crews scan for exactly this: they connect, exfiltrate, wipe the data, and leave a ransom note. The “Meow” attacks destroyed thousands of open databases this way.
- • It is one of the most common root causes of mass data breaches — no zero-day required.
By engine — and what's at stake
By country
- United States1,700
- China1,106
- Germany981
- France439
- Singapore298
- United Kingdom280
- Indonesia222
- Brazil217
- Netherlands207
- India205
Are you exposed?
Check whether your infrastructure has an open data store or other exposure — a free, passive scan of your own internet-facing surface, no signup.
Check your exposure →How it works
How do you know it's actually unauthenticated?
Each engine’s banner only returns server info / data when no auth is enforced (e.g. an open Redis answers INFO; a locked one returns a NOAUTH error). We infer the open state from that already-public Shodan banner — we never connect to or query the database ourselves.
Is this passive and legal?
Yes — it’s read-only threat intelligence over public banner data (the same data class as Shodan, Censys, Shadowserver). We never authenticate, query, read, or modify any database.
Why don't you list the IPs?
Publishing open-database IPs would be a target list for attackers. We keep host details private for responsible disclosure to affected organisations and publish only aggregate counts. (Use the scanner above to check your own exposure.)
Frequently asked questions
What is the Exposed Databases Radar?
A live count of databases — MongoDB, Elasticsearch, Redis, CouchDB, Memcached, Kibana and more — reachable on the public internet with no authentication. EchelonGraph finds them passively from public internet-scan banners and publishes only aggregate, host-redacted counts.
Why is an unauthenticated database dangerous?
Anyone on the internet can read, copy, ransom or wipe the data — no exploit required. Open databases are a leading cause of data breaches and automated wipe-for-ransom attacks; ransomware crews and scrapers actively hunt for them.
How does EchelonGraph detect open databases?
It reads public internet-scan banners that identify a database service and indicate it accepts unauthenticated connections. The check is passive and detect-only — EchelonGraph never connects to or reads any data, and results are aggregate and host-redacted.
How do I secure an exposed database?
Require authentication, bind the service to a private network or VPC instead of 0.0.0.0, place it behind a firewall or security group, and rotate any credentials that may have been exposed. A database should never be reachable directly from the public internet.
EchelonGraph-<Radar>/1.0 (+echelongraph.io/responsible-disclosure; support@echelongraph.io) and a From: support@echelongraph.io header. It is a single, passive, read-only check — we never log in, exploit, write, or read your data. Who we are, how we confirm exposures read-only, and how to opt out → Genuine requests also carry a signed receipt you can validate at /verify-scan.