Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
103.168.3.140 has a threat confidence score of 100%. This IP address from India (AS135761, Userlinks Netcom Pvt. Ltd.) has been observed in 25 honeypot sessions targeting TELNET protocols. Detected attack patterns include telnet busybox hex stager with unknown applet execution, telnet busybox hex payload dropper with execution and cleanup. First observed on March 11, 2026, most recently active March 11, 2026.
Automated Telnet-based compromise sequence involving CLI escalation, transition into shell access, multi-directory writable path probing (/var, /tmp, /dev, /mnt, /dev/shm, /usr), reconstruction of a binary payload using BusyBox hex-encoded echo commands (with and without newline suppression), retrieval of remote content via wget, execution attempt through a randomly named BusyBox applet, and forced recursive cleanup (rm -rf). The inclusion of an unknown BusyBox applet invocation strongly indicates execution of a staged or randomly named payload rather than standard utility usage. The overall sequence is characteristic of scripted IoT/Linux bot propagation frameworks performing automated deployment.
Structured BusyBox-driven payload deployment over Telnet. The operator reconstructs a binary or script via hex-encoded echo writes (including no-newline variants), stores it in hidden paths across common writable directories (/tmp, /dev/shm, /var, /mnt, etc.), optionally retrieves additional components via wget, executes the payload through shell/system/start invocation, and performs cleanup via recursive deletion. Includes device shell escape attempts and potential privilege escalation via su. This represents automated botnet loader activity rather than interactive administration.