Loading threats
Client issues a MongoDB insert command targeting a database named READ_ME_TO_RECOVER_YOUR_DATA, attempting to create or populate a README collection with ransom note content. The request includes ordered write semantics and a logical session identifier (lsid), reflecting use of modern MongoDB protocol features. This primitive represents database extortion or data-wiping campaign activity where an attacker attempts to leave recovery instructions after unauthorized access, deletion, or encryption of database contents.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 64.89.163.131 | 100% | 48,780 | 11,865 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 64.89.163.132 | 100% | 46,648 | 9,667 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 64.89.163.130 | 100% | 41,807 | 9,125 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 64.89.163.243 | 100% | 14,371 | 13,958 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 64.89.163.86 | 100% | 13,882 | 10,382 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 45.156.87.10 | 100% | 13,007 | 12,892 | 🇳🇱 NL | AS51396 |
| 2026-04-21 |
| 176.65.132.93 | 100% | 10,621 | 10,444 | 🇩🇪 DE | AS51396 | 2026-04-21 |
| 64.89.163.87 | 100% | 9,705 | 7,836 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 64.89.163.85 | 100% | 8,902 | 6,269 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 185.242.3.71 | 100% | 7,029 | 7,023 | 🇳🇱 NL | AS60223 | 2026-04-21 |
| 176.65.132.39 | 100% | 6,247 | 6,174 | 🇩🇪 DE | AS51396 | 2026-04-21 |
| 45.156.87.252 | 100% | 5,634 | 5,415 | 🇳🇱 NL | AS51396 | 2026-04-20 |
| 176.65.132.141 | 100% | 5,622 | 5,538 | 🇩🇪 DE | AS51396 | 2026-04-21 |
| 43.228.157.45 | 100% | 5,542 | 5,409 | 🇵🇰 PK | AS205759 | 2026-04-21 |
| 45.156.87.119 | 100% | 4,579 | 4,578 | 🇳🇱 NL | AS51396 | 2026-04-21 |
| 64.89.163.244 | 100% | 4,503 | 4,426 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 64.89.163.245 | 100% | 4,219 | 4,108 | 🇬🇧 GB | AS401626 | 2026-04-21 |
| 45.156.87.7 | 100% | 3,936 | 3,897 | 🇳🇱 NL | AS51396 | 2026-04-21 |
| 176.65.132.107 | 100% | 3,016 | 3,016 | 🇩🇪 DE | AS51396 | 2026-04-21 |
| 45.153.34.81 | 100% | 1,377 | 1,377 | 🇳🇱 NL | AS51396 | 2026-04-20 |