Have I Been Redised
Check it out at RedisPwned and Have I Been Redised
How it works
We scan the internet for exposed Redis databases broadcasting to the world on port 6379 - the default Redis port. This data is then corelated to a country of origin, redis version, etc and made searchable.
How the data is stored:
Each dataset has its own key (shodan:, censys:, etc) that is then aggregated via a unified search index: idx:redis-version-by-country-city-geo. This generic search index allows us to easily aggregate data from different sources.
How the data is accessed:
The api.redispwned.app fulfills all aggregation and scan requests from www.redispwned.app (www.haveibeenredised.com as well). The graphs are powered by querying the redispwned Redis database.
Aggregate Exposed Redis Databases
Top 25 By Country
FT.AGGREGATE idx: "*" GROUPBY 1 @country REDUCE COUNT 0 AS num SORTBY 2 @num DESC MAX 25
Top 5 By Redis Version
FT.AGGREGATE idx: "*" GROUPBY 1 @version REDUCE COUNT 0 AS num SORTBY 2 @num DESC
To frustrate the script lords and kiddies I've omitted the actual ipv4 data used - although readily obtainable with a research petition to the below sources.
Sources
- Censys Data: Censys Data
- Rapid7 Data: Rapid7 Open Data
- Shodan Data: Shodan Data
