Loading threats
Client sends a MongoDB listCollections command to the local database requesting enumeration of collection names with the nameOnly option enabled. The request includes an empty cursor specification and a logical session identifier (lsid), indicating use of modern MongoDB session semantics. This primitive reflects node-level reconnaissance activity where a client attempts to discover internal replication and local-state collections present on the MongoDB instance.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 64.89.163.131 | 100% | 49,037 | 12,122 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 64.89.163.132 | 100% | 46,690 | 9,709 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 64.89.163.130 | 100% | 41,847 | 9,165 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 64.89.163.243 | 100% | 14,557 | 14,144 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 64.89.163.86 | 100% | 14,121 | 10,621 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 45.156.87.10 | 100% | 13,085 | 12,970 | 🇳🇱 NL | AS51396 |
| 2026-04-24 |
| 176.65.132.93 | 100% | 10,928 | 10,751 | 🇩🇪 DE | AS51396 | 2026-04-23 |
| 64.89.163.87 | 100% | 9,898 | 8,029 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 64.89.163.85 | 100% | 9,068 | 6,435 | 🇬🇧 GB | AS401626 | 2026-04-23 |
| 185.242.3.71 | 100% | 7,170 | 7,164 | 🇳🇱 NL | AS60223 | 2026-04-23 |
| 176.65.132.39 | 100% | 6,457 | 6,384 | 🇩🇪 DE | AS51396 | 2026-04-24 |
| 176.65.132.141 | 100% | 5,773 | 5,689 | 🇩🇪 DE | AS51396 | 2026-04-24 |
| 45.156.87.252 | 100% | 5,735 | 5,516 | 🇳🇱 NL | AS51396 | 2026-04-24 |
| 43.228.157.45 | 100% | 5,692 | 5,559 | 🇵🇰 PK | AS205759 | 2026-04-24 |
| 64.89.163.244 | 100% | 4,666 | 4,589 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 45.156.87.119 | 100% | 4,645 | 4,644 | 🇳🇱 NL | AS51396 | 2026-04-24 |
| 64.89.163.245 | 100% | 4,396 | 4,285 | 🇬🇧 GB | AS401626 | 2026-04-24 |
| 45.156.87.7 | 100% | 4,175 | 4,136 | 🇳🇱 NL | AS51396 | 2026-04-23 |
| 176.65.132.107 | 100% | 3,070 | 3,070 | 🇩🇪 DE | AS51396 | 2026-04-24 |
| 35.233.95.0 | 100% | 1,821 | 948 | 🇧🇪 BE | AS396982 | 2026-04-12 |