Internet-exposed SQL Server instances and where to find them

In this post I dig through some data that Shodan provides for internet-exposed SQL Server instances, their versions and locations.

I occasionally check Shodan for SQL Server instances that are publicly exposed on the internet for anyone to poke at. I make a LinkedIn post about it (like this one) and then just leave it at that.
So, this time, I’ve decided to dig a bit more into that data and document it here.

Note: this isn’t a sponsored or affiliate post. I don’t get anything from you clicking on any of the links that lead to Shodan, and Shodan had absolutely no input in this post.
I’m just writing it because I really like Shodan and I think more IT pros should be familiar with it.

What is Shodan?

The simplest explanation is that Shodan is a search engine (think Google, Bing, Qwant, etc.) for devices and services exposed to the internet.

Want to find out which version of Microsoft IIS is the most popular?
Or find control software for malware? Or hosts affected by a newly discovered vulnerability?
Shodan can help with that.

Shodan collects this data by constantly scanning the internet for services across nearly 4000 ports.
This constant scanning is also why findings from today (i.e. count of internet-exposed SQL Server instances) might not match findings for the same search done tomorrow.
Even the total number of instances between the screenshots in this post vary a bit due to the time between each screenshot.

Querying Shodan for internet-exposed SQL Server instances

This is pretty straight-forward.
Just go to Shodan’s main page and type your search terms in the text field.

In this case my search string/query is “ms-sql server -browser”:

• “ms-sql” for obvious reasons since that’s part of the product name I’m interested in.
• “-browser” is there to exclude the SQL Server Browser Service as a distinct product.

The SQL Server Browser Service listens on UDP port 1434 and directs incoming connections to named instances. Including it in the results would inflate the total count without adding meaningful data, since the Browser Service only exists where SQL Server is already installed.

And the first page of results looks like this.

Here’s a direct link to the search results for that query, if you want to check for yourself.

Note that, at this time, Shodan shows 207K SQL Server instances exposed to the public internet.

In the left-hand side (marked with 1), you can see the total as well as an overview of some of the categories (or facets, as Shodan calls them) in which the results are broken down.

At the top we have a link to a Report (marked with 2) for this query, which takes you to a more overview style results page.

And in the center of the results page (marked with 3) you have the individual hosts. Next to each host there’s also a timestamp of when that host has last been seen.

Some things to keep in mind at this point:

• The eagle-eyed among you may have noticed that I’m not logged in yet.
  This is because simple searches (like the one I did now) and looking through the first page of the results (including accessing individual host info, the Report, and facets breakdown) doesn’t require an account and, as a result, doesn’t use up any Shodan query credits.
• Results are limited to 10 hosts per page.
• Advancing to pages beyond the first one requires an account and consumes one query credit per page.
• Using the API to interact with Shodan is way more cost-friendly than using the website.
  For example a query returning 100 results uses up a single query credit.

Looking at that number, I always wonder how many of those instances might be honeypots. And if that number is even 1% of the total.
I know a few folks in cybersecurity who periodically set up honeypots that also include known vulnerable versions of SQL Server.

Per-host information

I’m just going to use two hosts as examples here so that I don’t fill up the page with screenshots.

So, this host is running SQL Server 2005 SP3 on a Windows 7 SP1 or Windows Server 2008 R2 SP1 host.
Note those eol-os and eol-product tags, in case the antiquated version number isn’t telling enough of a story.

Now, let’s take a look at a host with some additional services running on it.

This Windows 8.1 or Windows Server 2012 R2 host, besides SQL Server 2017 RTM (RTM because people are allergic to patching), is also running IIS 8.5. Having IIS exposed to the internet actually makes sense for a web server.
But having NetBios (UDP 137) exposed to the public internet doesn’t make sense.

Version breakdown

Looking at the product facet breakdown, we can see which versions and in what numbers make up the grand total of 207K.

A few things I want to point out:

• 2019 RTM takes first place with 26.4K instances followed by 2022 RTM with 21.9K instances.
  So, at least the top 2 most “popular” versions aren’t EOL
• 2008 R2 RTM takes third place with 21.1K instances.
  So much for not being EOL.
• Only 2.6K instances running 2025 RTM/GA.
• That aversion to patching is really made clear by the fact that the top 6 versions are running RTM.

Note, this is just what I could fit in a single, non-scrolled, screenshot.

Aggregating per major version

Since each patch level is treated by Shodan as a distinct product, I want to aggregate this data by major version to get a better sense of which versions are the most “popular” in terms of exposure to the public internet.

For this, I queried Shodan’s API using SQL Server 2025’s sp_invoke_external_rest_endpoint and aggregated the results by major version.
I’ll cover the technical details and the query used to get this result in my next post, here I’m just focusing on the result itself.

One thing about that mysterious “MS-SQL Server” entry: these are instances for which Shodan could not determine the version.

The adoption rate of SQL Server 2025 among the “let me just put my instance up on the public internet” population isn’t great.

If you’re interested in the entire product facet dataset used for this result, you can find it in CSV format here in my blog’s GitHub repo.

Country breakdown – Top 10

For the breakdown by country and organization I’m going to be a bit lazy efficient and use the top 10 images that Shodan generates when you click that Chart button in the Facet Analysis view.

I don’t have anything specific to add here, China leads the chart with 43.1K publicly facing SQL Server instances, with the US taking second place with its 27.2K instances, and India taking third place with 13.4K.

Bonus: Romania breakdown

At the time of writing, Shodan shows 1296 publicly exposed SQL Server instances.

At a cursory glance through a handful of the identified hosts, it seems like some belong to small businesses (this is just based on information exposed by Shodan).

Given the cyberattack that took 100 Romanian hospitals offline back in 2024, this isn’t just purely informative.
If you manage SQL Server infrastructure in Romania, check your exposure.
Link to Shodan Romania-specific query.

Org breakdown – Top 10

I’m actually more curious about which organizations account for the top 10 in this breakdown.
Note that by Org this can either be an ISP in the case of private individuals, small and medium business that run their own servers and don’t have their own IP block(s) reservation(s), or a non-ISP in the case of large business or cloud providers.

Looks like it’s mostly cloud providers.
Korea Telecom appears to be both an ISP and a cloud provider.
Aliyun Computing is Alibaba Cloud, while Microsoft Corporation is self-explanatory (I’m guessing some of these are people running SQL Server on Azure VMs or Azure SQL MI).

The only ISP in the list seems to be CHINANET, which, as far as I can tell, isn’t in the cloud hosting business (although I might be wrong, in which case feel free to correct me in the comments).

Historical data

Once logged in, aside from being able to browse additional pages and use query filters, I can also see historical data.

Also note how the total count has changed in the meantime from 207K instances to 208K instances.

Now this is where security conscious folks can somewhat breathe a sigh of relief.
The number of publicly exposed SQL Server instances has been trending down, with its peak in April 2022 at 520K, it’s now lower than half that.

If you have SQL Server visible on the public internet

You can search Shodan for your external IP to see if you have any publicly exposed services, either type your IP in the search field or edit the following URL with your IP and use that: https://www.shodan.io/host/XXX.XXX.XXX.XXX.

If your instance is publicly visible but it doesn’t have to be, then disable public access, block TCP port 1433 (or whatever port your instance uses) and UDP port 1434 at your firewall and only allow trusted internal networks.

But if you really need your instance to be accessible from other places:

1. Consider setting up a VPN instead and use that to connect clients to your SQL Server instances.
2. Have strict “allow” firewall rules.
3. Upgrade and/or patch.
   Sorry, but if you have SQL Server 2000 accessible to the public internet and you get hacked then that’s all on you.
4. Harden all your SQL login passwords (you have a 128 character limit, use it), set them to lock out after 3 failed login attempts, and also audit for successful login attempts (note that you actually have to check the error log to see who logged in).
5. Apply the principle of least privilege.
6. Feel free to run PSBlitz and check out the security findings for anything that might be leveraged by an attacker.

Conclusion

Horrors beyond human comprehension.

But at least the total number of internet-exposed SQL Server instances is trending down and lower than half of what it was in 2022.

If you’re one of the folks running ancient versions of SQL Server on hosts that are exposed to the internet can you please explain why in the comments?