Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
118.193.65.209 has a very high threat confidence level of 90%, originating from City of London, United Kingdom, on the UCLOUD INFORMATION TECHNOLOGY HK LIMITED network (135377). It has been observed across 341 sessions targeting SMTP, HTTP, SSH, MONGODB, MSSQL and 2 other protocols, First observed on January 30, 2026, most recently active February 22, 2026.
FTP session where the client authenticates and performs repeated passive-mode directory listings while navigating directly into finance, HR, partner, vendor, and release paths such as /data/finance, /data/hr, /partners, and /pub/*, indicating targeted discovery of business-sensitive storage locations.
Identifies HTTP requests targeting the web server root path ("/"), typically used for initial service discovery, host validation, or baseline content inspection prior to deeper enumeration.
FTP session where the client issues AUTH TLS to upgrade the connection to Transport Layer Security. This reflects protocol-level encryption negotiation prior to further interaction.
Client issues MongoDB serverStatus requests and disconnects shortly after, indicating service inspection rather than active database interaction. This pattern is commonly associated with automated discovery activity where scanners collect runtime metrics or confirm database exposure without performing further queries.