410 Database Service Ports
Indexed on Sri Lankan IPs

What the Index Observes

Public internet indexing services probe publicly reachable ports and record the responses. For database services, this means the index captures whatever the server returns on connection: a version banner, an authentication challenge, an error message, or in some cases full server metadata. None of the data below was obtained by logging in, querying, or interacting further with any system. It reflects what the server responded with on initial contact.

Five queries were run: country:LK port:27017 product:MongoDB, country:LK port:3306 product:MySQL, country:LK port:5432 product:PostgreSQL, country:LK port:6379 product:Redis, and country:LK port:9200 product:Elasticsearch. Elasticsearch and Microsoft SQL Server (port 1433) returned zero indexed results for Sri Lankan IPs.

MongoDB: 5 Indexed Instances

Five MongoDB instances on Sri Lankan IPs were indexed on port 27017. All five banners include the field "Authentication partially enabled" in their server information response. This is MongoDB's own description of its authentication state, returned as part of the initial connection response.

Two of the five instances carry the index's eol-product tag. MongoDB 4.0 reached end-of-life in February 2022. MongoDB 5.0 reached end-of-life in October 2024. One instance on a version within those ranges also carries the compromised tag, applied by the index based on observed indicators.

The banner content does not establish whether the partial authentication state permits unauthenticated read or write operations. It establishes that the phrase appears in the server's own response and that the administrator of each instance should verify their authentication configuration is complete.

Redis: 9 Indexed Instances

Nine Redis instances were indexed on port 6379. Redis returns different responses depending on whether authentication is required. The majority of the nine indexed instances returned -NOAUTH Authentication required., indicating authentication is configured and the index's connection attempt was rejected.

However, at least one indexed instance returned a full server INFO block in response to the initial connection without an authentication challenge. This is the behavior of a Redis instance without a password set, or with an empty password. The index recorded version, memory usage, uptime, and connected client counts from this response. A second instance carries the index's compromised tag alongside a full INFO response.

Redis 2.8 reached end-of-life in 2015. An indexed Redis instance on a version from 2013, returning server metadata without an authentication challenge, represents a meaningful configuration concern. The content of the memory is not established by this data.

MySQL: 358 Indexed Instances

MySQL is by far the most indexed database product on Sri Lankan IPs, with 358 results on port 3306. This count alone does not indicate a security issue. MySQL, like most relational databases, announces its version as part of the initial handshake before any authentication exchange. A version banner in the index does not establish that the instance accepts unauthenticated connections.

What the index does reveal is version distribution. Several of the indexed instances are running versions that have passed end-of-life. MySQL 5.5 reached end-of-life in December 2018. MySQL 5.6 reached end-of-life in February 2021. Both appear in the indexed version distribution.

PostgreSQL: 38 Indexed Instances

38 PostgreSQL instances were indexed on port 5432. The banner responses visible in the index are largely authentication challenge messages: fe_sendauth: no password supplied is the client-side error returned when a connection is attempted without credentials. Its presence in the index indicates the server responded to the indexer's connection, and that the indexer did not supply a password. It does not establish unauthenticated access was possible.

One indexed instance returned FATAL: no pg_hba.conf entry for host, indicating the connection was rejected at the host-based authentication level. Several instances present self-signed certificates alongside the database service. The Lanka Education and Research Network (LEARN) accounts for a meaningful share of the indexed results, reflecting academic infrastructure with database services on public IPs.

Notable Patterns

What Is Not Established

This post does not establish that any indexed database instance accepts unauthenticated connections, exposes user data, or has been compromised. With the exception of Redis instances that returned full server metadata without an authentication challenge, the index data reflects version banners and initial connection responses. Authentication state, data contents, and actual access controls are not determinable from this data alone.

The finding that 358 MySQL instances, 38 PostgreSQL instances, 9 Redis instances, and 5 MongoDB instances are indexed on public Sri Lankan IPs is itself the primary observation. Database services on public IPs without a clear operational reason represent unnecessary exposure surface, independent of authentication configuration.

Summary

410 database service ports indexed across four products. No Elasticsearch. No MSSQL. Two MongoDB instances on EOL versions. Two Redis instances returning server metadata without an authentication challenge, one tagged as compromised by the index. MySQL version distribution skewed toward branches the vendor no longer patches.