Redis Exposure Across the EU: A Snapshot from Shodan Data

Methodology

Scope: 27 European Union member states

AT, BE, BG, HR, CY, CZ, DK, EE, FI, FR, DE, GR, HU, IE, IT, LV, LT, LU, MT, NL, PL, PT, RO, SK, SI, ES, SE

Query focus:

• Services responding on port 6379, typically associated with Redis.

Important context:

• Not everything on port 6379 is Redis
• Some services may be proxies, honeypots, or unrelated software
• Fingerprinting is based on Shodan visibility

The results reflect observable exposure, not confirmed configuration state.

Total Port 6379 Exposure in the EU

Total services responding on port 6379: 61,718

That is a large attack surface for a service that is commonly deployed without authentication in internal environments.

Germany, the Netherlands, and France account for the majority of visible exposure. This pattern mirrors hosting density and infrastructure concentration.

What Is Actually Running on Port 6379?

Fingerprinting results show a diverse ecosystem.

Most services appear to be genuine Redis instances. The presence of honeypots and unusual services reinforces that port-based exposure analysis provides visibility, not certainty.

Why Redis Exposure Is Particularly Dangerous

Redis historically runs without authentication in many internal deployments. Common characteristics of exposed Redis instances include:

• No password required
• No TLS enabled
• Bound to 0.0.0.0
• Running as root
• No firewall restrictions

If unauthenticated, an attacker can read and dump all keys, modify application session data, inject malicious values, or even achieve remote code execution via misconfiguration.

From a Pentester Perspective

When we discover an internet facing Redis instance, we immediately test:

• Is authentication required?
• Is TLS enabled?
• Is the instance bound to all interfaces?
• Can we run INFO or read keys?
• Can we write files via CONFIG and SAVE?

If no authentication is required, severity is typically Critical. Redis compromise can lead to remote code execution or privilege escalation through filesystem access.

Final Thoughts

61,718 services responding on port 6379 across the EU is not a small number. Redis was designed for trusted environments. The risk appears when it is directly reachable from the internet without authentication or segmentation.