Cloud Database Exposure: Internet-Wide Scanner Sweep (2D)

Database Network Config

Scan clock

Simulated time speed 15 min/s

Not deployed yet

Time exposed (simulated)

00:00:00

Scan sweeps done

Probes bounced

Records exfiltrated

0 / 0

How this works

Internet-wide scanners don't pick individual targets — they sweep every routable IPv4 address, port by port, on a loop that repeats every few hours. The rotating radar arm is that sweep front, moving steadily around the whole address ring.

An open/misconfigured database has no authentication and no IP allow-list, so the moment the sweep arm reaches its address it is indistinguishable from any other open port — it gets fingerprinted and, within seconds, an automated bot connects and starts pulling rows out.

A firewalled database only accepts connections from a pre-approved IP range. The scan probe still reaches its address — TCP resets the connection instantly — so the sweep gains nothing and moves on, forever.

Time exposed — for the open config this freezes at the moment of discovery, showing the real window of safety. For the firewalled config it just keeps climbing.
Simulated time speed — compresses hours of scanning into seconds so the discovery event is actually observable.

Scan sweep arm Database — safe Database — breached Exfil connection