How to secure your MongoDb

Number of Transactions

Known Attacker IPs

Victims (OSINT)

Victims (helped)

SEND 0.5 BTC (BITCOIN) TO THIS ADDRESS 1LyVyAsQz5TcBH97LdXszmsp8PW7VP3SCp AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE!

e95189a57d3ed6722f6583055e666857351eb69a1064d51c275f98dce22316b4

0704341626asdf@signaint.org

Your database has been pwned because it is publicly accessible at port 27017 with no authentication (wtf were you thinking?). Your data has been dumped (with data types preserved), and is easily restorable. To get your data back, email the supplied email after sending 0.15BTC to the supplied Bitcoin wallet, do this quickly as after 72 hours your data will be erased (if an email is not sent by then). We will get back to you within 2 days. All of your data will be restored to you upon payment via a email response.

Your database has been pwned because it is publically accessible at port 27017 with no authentication (wtf were you thinking?). Your data has been dumped (with data types preserved), and is easily restoreable. To get your data back, email the supplied email after sending 0.15BTC to the supplied Bitcoin wallet, do this quickly as after 72 hours your data will be erased (if an email is not sent by then). We will get back to you within 2 days. All of your data will be restored to you upon payment via a email response. We do admit it is possible we overwrote another groups warning after they hit you. In this case, we will refund you 75% and send you the emails of the other groups. We are not animals. In fact, you should be glad we hit you before some groups did something terrible with your data like sell it online

Send 0.5 Bitcoin to address 1GZSWuA7EC1y1cZ2c85CnnsD1cNk67yAUc and contact email with server IP to recover database!

There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. You are welcome!

There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. You are welcome!

21-01-2017 17:52:43

You DB is backed up on our servers, send 1 BTC to 1J5ADzFv1gx3fsUPUY1AWktuJ6DF9P6hiF then send your ip address to email:kraken0@india.com"

Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip

Your DB is Backed up at our servers, to restore send 0.5 BTC to the Bitcoin Address then send an email with your server ip

82128cdbfbd34a6ec41dd846dee37246251a2620a8ebcb435a1b50ad850e84ce

Your DB is Backed up at our servers, to restore send 0.2 BTC to the Bitcoin Address then send an email with your server ip

82128cdbfbd34a6ec41dd846dee37246251a2620a8ebcb435a1b50ad850e84ce

YOUR DBS ARE ENCRYPTED. SEND 0.5 BTC (BITCOIN) ~= 550USD, TO THIS BTC ADDRESS: 15b7bS8tUg8NpzX2FRJQskEFjWRDg9gy6f AND CONTACT THIS EMAIL: 0wn3d@protonmail.com WITH THE IP OF YOUR LOCKED SERVER TO RECOVER YOUR DBS!

SEND 0.2 BTC TO THIS ADDRESS 1j4ocBecBanTwjLsxLfiE7iWjMJGHdZGB AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !

to_get_DB_back_send_1BTC_to_1DGztzLNz1euFswtqMDWPMWSgwthdpxRtC

to_get_DB_back_send_1BTC_to_1DGztzLNz1euFswtqMDWPMWSgwthdpxRtC

DELETED_BECAUSE_YOU_DIDNT_PASSWORD_PROTECT_YOUR_MONGODB

https://twitter.com/MongoDBatSO/status/625905480708304896
https://stackoverflow.com/questions/31668222/mongodb-throws-delete-message-deleted-because-you-didnt-password-protect-your-m

SEND 0.2 BTC TO THIS ADDRESS 1Hhb4rJY7hYFMLwE1j1834zWsNBRWXN9Sv AND CONTACT THIS EMAIL WITH YOUR IP OF YOUR SERVER TO RECOVER YOUR DATABASE !

PLEASE_READ_56b41cc944bd390932e79827

Your DB is Backed up at our servers, to restore send 1.0 BTC to the Bitcoin Address then send an email with your server ip

Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip

Your DB is Backed up at our servers, to restore send 0.2 BTC to the Bitcoin Address then send an email with your server ip

Note: 5 servers in Germany attacked.. looking for Note and information

This is clearly a targeted attack on 1 company

DBS ENCRYPTED. CONTACT baby8@sigaint.org TO RECOVER YOUR DBS!

SEND 0.1 BTC TO THIS ADDRESS 1GMCQAuuVJWWRpDdA919VVMDU7VEwDnicM AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE !

NOTE : "SEND 0.1 BTC TO THIS ADDRESS 1CRtmFHhDL83sgg8Gwd8gZEW7rgvjNCrGF AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE! ", NOTICE : "IF YOU DO NOT PAY YOUR DATABASE WILL BE PUBLISHED ONLINE EVERYONE WILL KNOW YOUR BREACH OF SECURITY"

Send 0.1 Bitcoin to walletaddress 1PWFTSbye9hzfp6RH453hDJb2Ujeice8ZQ and contact m3lk@sigaint.org to get your databases back.

Send 0.1 Bitcoin to walletaddress 131qpnP9v2qGKbrAQirCZzunyw5x3dADsBand contact m3lk@sigaint.org to get your databases back.

Your DB is Backed up at our servers, to restore send 0.05 BTC to the Bitcoin Address then send an email with your server ip

40e95a2d6fb476409a54809789f0b211bc79309b0872bfc31fc0e02b8c2e0948

Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip

Your DB is Backed up at our servers, to restore send 0.1 BTC to the Bitcoin Address then send an email with your server ip (or domain name)

1-15-2017 17:23:16.775

86f625b35ea2bf8c0cee68d0bf2a3b77d0c9a2f804b310e863860d15fe1145b9

SEND 0.5 BTC (BITCOIN) TO THIS ADDRESS 13QAcXUtNA9UGHPRy1GLDE9zWsDCbKzf2B AND CONTACT THIS EMAIL WITH IP OF YOUR SERVER TO RECOVER YOUR DATABASE!

There Is Always A Solution" : "Your DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. Any eMail without your MongoDB server IP Address and a Proof of Payment together will be ignored. You are welcome!"

YOU HAVE BEEN HACKED. SEND 0.2 BITCOIN TO BITCOIN ADDRESS 1B4kMRmY4yb4XW8hHnYRZT1WWNfnPfPbHR AND EMAIL vxware@sigaint.org WITH YOUR SERVER IP TO RECOVER YOUR DATABASES. HOW TO BUY BITCOIN: https://www.coinbase.com/buy-bitcoin https://en.bitcoin.it/wiki/Buying_Bitcoins_(the_newbie_version)

"Don't panic. Your DB is in safety and backed up (check logs). To restore send 0.1 BTC and email with your server ip or domain name. Each 48 hours we erase all data.

Your DB is in safety and backed up (check logs). To restore send 0.1 BTC and email with your server ip or domain name. Each 24 hours we erase all data.

Don't panic. Your DB is in safety and backed up (check logs). To restore send 0.2 BTC and email with your server ip or domain name. Each 24 hours we erase all data.

We have your data. Your database is backed up to our servers. If you want to restore it, then send 0.2 BTC and text me to email, just send your IP-add...

Your DataBase is downloaded and backed up on our secured servers. To recover your lost data: Send 0.2 BTC to our BitCoin Address and Contact us by eMail with your MongoDB server IP Address and a Proof of Payment. Any eMail without your MongoDB server IP Address and a Proof of Payment together will be ignored. You are welcome!

If you want to recover your data, then send 0.05 BTC to bitcoin-address and send your IP to our email. You don't want that your users/customers to know that you have a data leak, right?

We have your data. Your database is backed up to our servers. If you want to restore it, then send 0.15 BTC and text me to email, just send your IP-address and payment info. Messages without payment info will be ignored

@MayhemDayOne

Don't panic. Your DB is in safety and backed up (check logs). To restore send 0.2 BTC and email with your server ip or domain name. Each 24 hours we erase all data

"BitCoin" : "13yDqr3VptUpYr84s3id3HFAd3HC1KmLPm", "eMail" : "butterfly@safe-mail.net", "Exchange" : "https://localbitcoins.com or https://www.okex.com", "Solution" : "Your Data is downloaded and backed up on our secured servers. To recover your lost data: Send 0.1 BTC to our BitCoin Address and Contact us by eMail with your server IP Address and a Proof of Payment. Any eMail without your server IP Address and a Proof of Payment together will be ignored. You are welcome!"

@MayhemDayOne

Your Database is downloaded and backed up on our secured servers. To recover your lost data: Send 0.6 BTC to our BitCoin Address and Contact us by eMail with your server IP Address and a Proof of Payment. Any eMail without your server IP Address and a Proof of Payment together will be ignored. We will drop the backup after 24 hours. You are welcome!

@MayhemDayOne

Your database was encrypted by 'Mongo Lock'. if you want to decrypt your database, need to be pay us 0.1 BTC (Bitcoins), also don't delete 'Unique_KEY' and save it to safe place, without that we cannot help you.

dbbak_service@protonmail.com

3CUGBF9QUStiLc2kCiArcE7kkmX93UFHBb", "eMail" : "dbbak_service@protonmail.com", "Exchange" : "https://localbitcoins.com/", "Solution" : "Your Database is downloaded and backed up on our secured servers. To recover your lost data: Send 0.6 BTC to our BitCoin Address and Contact us by eMail with your server IP Address and a Proof of Payment. Any eMail without your server IP Address and a Proof of Payment together will be ignored.You are welcome!

hacktheworld.mm@protonmail.com

{
"_id" : ObjectId("5b95f73a67dcc17ed043bafa"),
"BitCoin" : "36ma7R1fPkxjs3mxo4TqPLNpzPk4FEo41k",
"eMail" : "hacktheworld.mm@protonmail.com",
"How To Buy" : "https://www.coinbase.com/buy-bitcoin",
"Solution" : "Your Database is downloaded and backed up on our secured servers. To recover your lost data: Send 0.5 BTC to our BitCoin Address and Contact us by eMail with your server IP Address and a Proof of Payment. Any eMail without your server IP Address and a Proof of Payment together will be ignored. You are welcome!"
}

{ "_id" : ObjectId("5c146fb788d92c5dce34d5ae"), "note" : "YOUR DATABASE WAS WIPED CLEAN AND THE COPY IS BACKED UP ON OUR SERVERS", "description" : "TO RECOVER YOUR DATA SEND 0.5 BITCOIN TO 1HpBkAEp2fyKXpHAS1z5hAwJx1Gk3bdXa1 AND SEND AN EMAIL TO mongorestore@secmail.pro WITH YOUR SERVER IP ADDRESS. THE DATABASE WILL BE PERMANENTLY ERASED AFTER 48 HOURS", "email" : "mongorestore@secmail.pro", "bitcoinwallet" : "1HpBkAEp2fyKXpHAS1z5hAwJx1Gk3bdXa1" }

104.131.144.104

104.131.144.151

104.131.144.180

104.131.144.190

104.131.144.194

104.131.144.195

104.131.145.115

104.131.145.145

104.131.145.148

104.131.145.149

104.131.145.194

104.131.146.111

104.131.146.118