Check an IP Address, Domain Name, Subnet, or ASN
222.118.160.173 has a threat confidence score of 93%. This IP address from South Korea (AS4766, Korea Telecom) has been observed in 12 honeypot sessions and reported 1 times targeting TELNET protocols. Detected attack patterns include telnet busybox hidden binary stager execution. First observed on January 21, 2026, most recently active March 22, 2026.
Identifies a Telnet session where BusyBox is used to construct a binary payload via echo redirection into a writable hidden file, followed by shell activation (sh, shell, system, linuxshell, enable), directory manipulation, and execution of the staged file. The combination of binary invocation, file creation through BusyBox redirection, hidden file usage, shell breakout, and connectivity validation (ping) indicates active payload staging and execution rather than simple reconnaissance. This pattern is strongly associated with embedded Linux and IoT malware deployment workflows.
| Reporter | Date | Category | Protocol | Comment |
|---|---|---|---|---|
| User | Mar 19, 2026, 10:03 | Brute Force | TELNET | SikkerGuard: 4 blocked packets |