Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
117.139.231.194 has a threat confidence score of 100%. This IP address from China (AS9808, China Mobile Communications Group Co., Ltd.) has been observed in 301 honeypot sessions targeting MYSQL protocols. Detected attack patterns include mysql udf exiles exe staged execution. First observed on March 31, 2026, most recently active April 1, 2026.
Sequence where a MySQL UDF is created from a shared library (multiple variants observed), followed by invocation of functions such as downloader/xpdl3 to retrieve the exiles.exe payload and write it to a Windows path. Includes prior environment probing via SELECT @@version_comment.