Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
160.248.160.39 has a very high threat confidence level of 85%, originating from Japan, on the NTT PC Communications, Inc. network (2514). It has been observed across 1 sessions targeting TELNET, with detected attack patterns including telnet busybox hidden binary stager execution, First observed on February 9, 2026, most recently active February 9, 2026.
Identifies a Telnet session where BusyBox is used to construct a binary payload via echo redirection into a writable hidden file, followed by shell activation (sh, shell, system, linuxshell, enable), directory manipulation, and execution of the staged file. The combination of binary invocation, file creation through BusyBox redirection, hidden file usage, shell breakout, and connectivity validation (ping) indicates active payload staging and execution rather than simple reconnaissance. This pattern is strongly associated with embedded Linux and IoT malware deployment workflows.