Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
211.198.197.93 has a threat confidence score of 100%. This IP address from South Korea (AS4766, Korea Telecom) has been observed in 1,708 honeypot sessions targeting MYSQL protocols. Detected attack patterns include mysql udf exiles exe staged execution. First observed on April 8, 2026, most recently active April 12, 2026.
Sequence where a MySQL UDF is created from a shared library (multiple variants observed), followed by invocation of functions such as downloader/xpdl3 to retrieve the exiles.exe payload and write it to a Windows path. Includes prior environment probing via SELECT @@version_comment.