I Analysed Over 3 Million Exposed Databases Using Netlas

Chapter 2 of the unprotected-database series: MongoDB and other cases of fully exposed DBMS instances, extra Netlas searches to widen the perimeter, and reminders on research ethics.

How to find exposed configs, API keys, database credentials, bearer tokens and debug outputs at scale using Netlas response data — mapped to OWASP Top 10:2025 exposure categories.

Casey Ellis covers ransom attacks wiping internet-facing datastores—34,000+ MongoDB databases erased, 1,600 Elasticsearch clusters hit—urging backups, authentication, isolation and IP whitelisting.

A practical MongoDB vs. Elasticsearch comparison for Ivy, Quarkslab's large-scale network reconnaissance tool: storing and mining unstructured data on ordinary hardware, and the trade-offs involved.

Netlas maps Windows PnP auto-install from DEF CON's Plug & Pwn: the OS fetches and runs vendor packages as SYSTEM; the remote variant rides authenticated RDP, so exposure can be scoped from outside.

Threat actors abuse Telegram's Bot API as a covert channel for phishing, telemetry and malware delivery; Netlas hunts surface Xeno lures and fake Adobe updates with stable detection anchors.