Loading threats
Client sends a MongoDB listCollections command to the config database requesting enumeration of collection names with the nameOnly flag enabled. The request includes an empty cursor specification and a logical session identifier (lsid), indicating use of modern MongoDB session semantics. This primitive reflects cluster metadata reconnaissance activity where a client attempts to discover internal sharding and configuration collections present in the deployment.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 64.89.163.131 | 100% | 46,216 | 9,330 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 64.89.163.132 | 100% | 45,805 | 8,824 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 64.89.163.130 | 100% | 41,157 | 8,487 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 64.89.163.243 | 100% | 12,034 | 11,621 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 45.156.87.10 | 100% | 11,219 | 11,104 | 🇳🇱 NL | AS51396 | 2026-04-06 |
| 64.89.163.86 | 100% | 11,215 | 7,725 | 🇬🇧 GB | AS401626 |
| 2026-04-06 |
| 64.89.163.85 | 100% | 8,380 | 5,747 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 64.89.163.87 | 100% | 8,355 | 6,486 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 176.65.132.93 | 100% | 7,685 | 7,508 | 🇩🇪 DE | AS51396 | 2026-04-06 |
| 185.242.3.71 | 100% | 5,064 | 5,060 | 🇳🇱 NL | AS60223 | 2026-04-06 |
| 176.65.132.39 | 100% | 4,868 | 4,795 | 🇩🇪 DE | AS51396 | 2026-04-06 |
| 45.156.87.252 | 100% | 4,488 | 4,269 | 🇳🇱 NL | AS51396 | 2026-04-06 |
| 176.65.132.141 | 100% | 4,052 | 3,968 | 🇩🇪 DE | AS51396 | 2026-04-04 |
| 45.156.87.119 | 100% | 3,024 | 3,023 | 🇳🇱 NL | AS51396 | 2026-04-06 |
| 43.228.157.45 | 100% | 2,581 | 2,448 | 🇵🇰 PK | AS205759 | 2026-04-06 |
| 45.156.87.7 | 100% | 2,499 | 2,460 | 🇳🇱 NL | AS51396 | 2026-04-06 |
| 64.89.163.244 | 100% | 2,363 | 2,286 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 64.89.163.245 | 100% | 2,057 | 1,946 | 🇬🇧 GB | AS401626 | 2026-04-06 |
| 35.233.95.0 | 100% | 1,745 | 872 | 🇧🇪 BE | AS396982 | 2026-04-02 |
| 34.52.219.24 | 100% | 1,694 | 494 | 🇧🇪 BE | AS396982 | 2026-04-06 |