Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
103.87.9.174 has a threat confidence score of 93%. This IP address from Hong Kong (AS132883, TOPWAY GLOBAL LIMITED) has been observed in 104 honeypot sessions targeting MONGODB, POSTGRES, MSSQL protocols. First observed on March 19, 2026, most recently active March 21, 2026.
Performs a full MongoDB authentication attempt against the admin database using the SCRAM-SHA-256 mechanism. The behavior combines capability probing via isMaster speculative authentication metadata with explicit saslStart and saslContinue SASL commands, indicating an actor attempting credential-based access to a MongoDB instance through the standard SCRAM authentication workflow.