Loading threats
Client issues a MongoDB find query against the orders collection in the production database using an empty filter, indicating an attempt to enumerate all order or transaction records within the application dataset. The request includes a logical session identifier (lsid), reflecting use of session-aware MongoDB protocol features. This primitive represents application data reconnaissance activity where a client attempts to retrieve bulk transactional information such as purchase history, order metadata, or financial workflow records from a production environment.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 64.89.163.132 | 100% | 44,756 | 7,775 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 64.89.163.131 | 100% | 43,393 | 6,562 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 64.89.163.130 | 100% | 40,013 | 7,343 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 45.156.87.10 | 100% | 9,775 | 9,660 | 🇳🇱 NL | AS51396 | 2026-03-19 |
| 64.89.163.86 | 100% | 7,857 | 4,381 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 64.89.163.85 | 100% | 7,488 | 4,855 | 🇬🇧 GB | AS401626 |
| 2026-03-19 |
| 64.89.163.87 | 100% | 7,220 | 5,357 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 64.89.163.243 | 100% | 4,478 | 4,263 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 176.65.132.93 | 100% | 4,128 | 3,962 | 🇩🇪 DE | AS51396 | 2026-03-19 |
| 176.65.132.141 | 100% | 2,678 | 2,594 | 🇩🇪 DE | AS51396 | 2026-03-19 |
| 45.156.87.252 | 100% | 2,538 | 2,319 | 🇳🇱 NL | AS51396 | 2026-03-19 |
| 176.65.132.39 | 100% | 2,502 | 2,429 | 🇩🇪 DE | AS51396 | 2026-03-19 |
| 185.242.3.71 | 100% | 1,643 | 1,639 | 🇳🇱 NL | AS60223 | 2026-03-19 |
| 45.156.87.119 | 100% | 1,505 | 1,504 | 🇳🇱 NL | AS51396 | 2026-03-19 |
| 45.156.87.7 | 100% | 1,296 | 1,260 | 🇳🇱 NL | AS51396 | 2026-03-19 |
| 64.89.163.245 | 99% | 908 | 797 | 🇬🇧 GB | AS401626 | 2026-03-19 |
| 45.153.34.81 | 100% | 620 | 620 | 🇳🇱 NL | AS51396 | 2026-03-19 |
| 43.228.157.45 | 100% | 608 | 584 | 🇵🇰 PK | AS205759 | 2026-03-19 |
| 64.89.163.244 | 100% | 593 | 593 | 🇬🇧 GB | AS401626 | 2026-03-19 |