Check an IP Address, Domain Name, Subnet, or ASN
64.89.163.178 has a very high threat confidence level of 100%, originating from United Kingdom, on the Netiface America, Inc. network (401626). It has been observed across 3,815 sessions targeting MYSQL, with detected attack patterns including mysql pre extortion valuation and ransom drop, mysql targeted database destruction, mysql ransom extortion workflow, First observed on January 24, 2026, most recently active March 3, 2026.
Performs a structured MySQL extortion workflow that first disables autocommit and calculates database size via information_schema to assess data value, then enumerates tables, creates a ransom table, inserts explicit extortion messages with payment instructions, and commits the transaction—clearly indicating intentional database extortion following valuation.
Explicitly disables autocommit, then deliberately drops multiple named databases and commits the transaction, indicating intentional and controlled destructive activity against specific MySQL databases rather than reconnaissance or misconfiguration.
Performs a coordinated sequence of MySQL actions to create and select a ransom-themed database and table, insert extortion markers, and explicitly manage transactions, clearly signaling database compromise and intent to extort the owner
Disables MySQL autocommit mode without performing any follow-up actions, indicating an initial transaction manipulation probe or a failed/aborted attempt to prepare multi-step database operations. Often seen in low-confidence automation or disrupted attack flows.
| Date | Category | Protocol | Comment |
|---|---|---|---|
| Feb 25, 2026 | Brute Force | MYSQL | SikkerGuard: 2 blocked packets |