Loading threats
Client sends a MongoDB listCollections command to the config database requesting enumeration of collection names with the nameOnly flag enabled. The request includes an empty cursor specification and a logical session identifier (lsid), indicating use of modern MongoDB session semantics. This primitive reflects cluster metadata reconnaissance activity where a client attempts to discover internal sharding and configuration collections present in the deployment.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 64.89.163.132 | 100% | 44,957 | 7,976 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 64.89.163.131 | 100% | 43,846 | 6,999 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 64.89.163.130 | 100% | 40,159 | 7,489 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 45.156.87.10 | 100% | 9,855 | 9,740 | 🇳🇱 NL | AS51396 | 2026-03-22 |
| 64.89.163.86 | 100% | 8,548 | 5,072 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 64.89.163.85 | 100% | 7,668 | 5,035 | 🇬🇧 GB | AS401626 |
| 2026-03-22 |
| 64.89.163.87 | 100% | 7,414 | 5,551 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 64.89.163.243 | 100% | 5,745 | 5,502 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 176.65.132.93 | 100% | 4,614 | 4,448 | 🇩🇪 DE | AS51396 | 2026-03-22 |
| 45.156.87.252 | 100% | 2,825 | 2,606 | 🇳🇱 NL | AS51396 | 2026-03-22 |
| 176.65.132.39 | 100% | 2,769 | 2,696 | 🇩🇪 DE | AS51396 | 2026-03-22 |
| 176.65.132.141 | 100% | 2,768 | 2,684 | 🇩🇪 DE | AS51396 | 2026-03-22 |
| 185.242.3.71 | 100% | 2,268 | 2,264 | 🇳🇱 NL | AS60223 | 2026-03-22 |
| 45.156.87.119 | 100% | 1,663 | 1,662 | 🇳🇱 NL | AS51396 | 2026-03-22 |
| 45.156.87.7 | 100% | 1,423 | 1,387 | 🇳🇱 NL | AS51396 | 2026-03-22 |
| 43.228.157.45 | 100% | 1,008 | 909 | 🇵🇰 PK | AS205759 | 2026-03-22 |
| 64.89.163.245 | 100% | 995 | 884 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 34.38.83.65 | 100% | 890 | 498 | 🇧🇪 BE | AS396982 | 2026-03-22 |
| 64.89.163.244 | 100% | 871 | 871 | 🇬🇧 GB | AS401626 | 2026-03-22 |
| 45.153.34.81 | 100% | 741 | 741 | 🇳🇱 NL | AS51396 | 2026-03-22 |