Check an IP Address, Domain Name, Subnet, or ASN

103.27.109.179 was found in our database!

$ whois 103.27.109.179

country·🇭🇰 Hong Kong

isp·TOPWAY GLOBAL LIMITED

asn·AS132883

network·Standard

$ sikker risk 103.27.109.179scoring →

confidence

87%Very High

first_seen·Mar 19, 2026

last_seen·4h ago

sessions·57

events·57

$ sikker protocols 103.27.109.179

POSTGRES

30 / 30

MONGODB

17 / 17

MSSQL

10 / 10

$ sikker summary 103.27.109.179

103.27.109.179 has a threat confidence score of 87%. This IP address from Hong Kong (AS132883, TOPWAY GLOBAL LIMITED) has been observed in 57 honeypot sessions targeting POSTGRES, MONGODB, MSSQL protocols. First observed on March 19, 2026, most recently active March 21, 2026.

$ sikker behaviors 103.27.109.179catalog →

mediumMongodb Scram Sha256 Admin Authentication Sequence8x

Performs a full MongoDB authentication attempt against the admin database using the SCRAM-SHA-256 mechanism. The behavior combines capability probing via isMaster speculative authentication metadata with explicit saslStart and saslContinue SASL commands, indicating an actor attempting credential-based access to a MongoDB instance through the standard SCRAM authentication workflow.

$ sikker primitives 103.27.109.179

postgres_select_table_contents94 postgres_ping_comment_marker53 mongodb_saslstart_scram_sha256_admin8 mongodb_saslcontinue_scram_sha256_admin8 mongodb_ismaster_scram_sha256_speculative_auth_admin8

$ sikker related 103.27.109.179

🇭🇰·More threats fromHong Kong→AS·More threats fromTOPWAY GLOBAL LIMITED→POST·More threats targetingPOSTGRES→MONG·More threats targetingMONGODB→MSSQ·More threats targetingMSSQL→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
103.27.108.70	96%	209
103.87.9.174	93%	140
103.43.17.148	13%	7
203.83.11.200	24%	30
203.83.11.193	46%	26

IP Address	Confidence	Events
103.143.238.222	97%	1,528
124.156.160.12	96%	2,704
47.76.100.209	86%	5,776
43.154.222.15	97%	377
172.110.223.49	98%	18,733