Check an IP Address, Domain Name, Subnet, or ASN
66.132.172.223 has a threat confidence score of 76%. This IP address from United States (AS398324, Censys, Inc.) has been observed in 18 honeypot sessions targeting SMTP, IMAP, REDIS, MONGODB, ELASTICSEARCH protocols. First observed on March 21, 2026, most recently active March 21, 2026.
Remote client performs MongoDB service validation and environment fingerprinting by first initiating a wire-protocol handshake (ismaster / hello) followed by execution of the buildInfo command against the admin database. This sequence indicates targeted reconnaissance to determine server role, software version, build characteristics, and platform details. Such activity is commonly associated with automated scanning frameworks and pre-exploitation tooling used to assess exposure and identify version-specific vulnerabilities prior to authentication attempts or database enumeration