Check an IP Address, Domain Name, Subnet, or ASN
120.211.145.102 has a threat confidence score of 53%. This IP address from China (AS24547, Hebei Mobile Communication Company Limited) has been observed in 6 honeypot sessions targeting MONGODB, REDIS, HTTPS, ELASTICSEARCH protocols. First observed on February 4, 2026, most recently active March 26, 2026.
Remote client performs MongoDB service validation and environment fingerprinting by first initiating a wire-protocol handshake (ismaster / hello) followed by execution of the buildInfo command against the admin database. This sequence indicates targeted reconnaissance to determine server role, software version, build characteristics, and platform details. Such activity is commonly associated with automated scanning frameworks and pre-exploitation tooling used to assess exposure and identify version-specific vulnerabilities prior to authentication attempts or database enumeration
Client performs a direct request to the Elasticsearch /_cat/indices endpoint and retrieves a successful response without preceding generic web discovery or multi-protocol probing. This behavior indicates targeted Elasticsearch reconnaissance focused on enumerating available indices, document counts, and storage size to assess data exposure. Unlike broad internet scanners, the interaction is Elasticsearch-aware from the start, suggesting tooling or operators specifically searching for open clusters rather than conducting general service fingerprinting.