Loading threats
Client issues a MongoDB insert command targeting a database named READ_ME_TO_RECOVER_YOUR_DATA, attempting to create or populate a README collection with ransom note content. The request includes ordered write semantics and a logical session identifier (lsid), reflecting use of modern MongoDB protocol features. This primitive represents database extortion or data-wiping campaign activity where an attacker attempts to leave recovery instructions after unauthorized access, deletion, or encryption of database contents.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 64.89.163.131 | 100% | 47,288 | 10,402 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 64.89.163.132 | 100% | 45,895 | 8,914 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 64.89.163.130 | 100% | 41,218 | 8,548 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 64.89.163.243 | 100% | 12,784 | 12,371 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 45.156.87.10 | 100% | 11,729 | 11,614 | 🇳🇱 NL | AS51396 | 2026-04-09 |
| 64.89.163.86 | 100% | 11,623 | 8,133 | 🇬🇧 GB | AS401626 |
| 2026-04-09 |
| 64.89.163.87 | 100% | 8,746 | 6,877 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 64.89.163.85 | 100% | 8,542 | 5,909 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 176.65.132.93 | 100% | 8,303 | 8,126 | 🇩🇪 DE | AS51396 | 2026-04-09 |
| 185.242.3.71 | 100% | 5,280 | 5,276 | 🇳🇱 NL | AS60223 | 2026-04-09 |
| 176.65.132.39 | 100% | 5,000 | 4,927 | 🇩🇪 DE | AS51396 | 2026-04-09 |
| 45.156.87.252 | 100% | 4,734 | 4,515 | 🇳🇱 NL | AS51396 | 2026-04-09 |
| 176.65.132.141 | 100% | 4,364 | 4,280 | 🇩🇪 DE | AS51396 | 2026-04-09 |
| 43.228.157.45 | 100% | 3,487 | 3,354 | 🇵🇰 PK | AS205759 | 2026-04-09 |
| 45.156.87.119 | 100% | 3,450 | 3,449 | 🇳🇱 NL | AS51396 | 2026-04-09 |
| 45.156.87.7 | 100% | 2,907 | 2,868 | 🇳🇱 NL | AS51396 | 2026-04-09 |
| 64.89.163.244 | 100% | 2,735 | 2,658 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 64.89.163.245 | 100% | 2,622 | 2,511 | 🇬🇧 GB | AS401626 | 2026-04-09 |
| 176.65.132.107 | 100% | 2,109 | 2,109 | 🇩🇪 DE | AS51396 | 2026-04-09 |
| 45.153.34.81 | 100% | 1,305 | 1,305 | 🇳🇱 NL | AS51396 | 2026-04-05 |