Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
223.123.38.35 has a very high threat confidence level of 100%, originating from Pakistan, on the CMPak Limited network (138423). It has been observed across 971 sessions targeting TELNET, HTTP, HTTPS, with detected attack patterns including telnet busybox hex stager with unknown applet execution, telnet busybox hex payload dropper with execution and cleanup, http gpon mozi botnet rce chain, First observed on January 20, 2026, most recently active March 2, 2026.
Automated Telnet-based compromise sequence involving CLI escalation, transition into shell access, multi-directory writable path probing (/var, /tmp, /dev, /mnt, /dev/shm, /usr), reconstruction of a binary payload using BusyBox hex-encoded echo commands (with and without newline suppression), retrieval of remote content via wget, execution attempt through a randomly named BusyBox applet, and forced recursive cleanup (rm -rf). The inclusion of an unknown BusyBox applet invocation strongly indicates execution of a staged or randomly named payload rather than standard utility usage. The overall sequence is characteristic of scripted IoT/Linux bot propagation frameworks performing automated deployment.
Structured BusyBox-driven payload deployment over Telnet. The operator reconstructs a binary or script via hex-encoded echo writes (including no-newline variants), stores it in hidden paths across common writable directories (/tmp, /dev/shm, /var, /mnt, etc.), optionally retrieves additional components via wget, executes the payload through shell/system/start invocation, and performs cleanup via recursive deletion. Includes device shell escape attempts and potential privilege escalation via su. This represents automated botnet loader activity rather than interactive administration.
Observed exploitation chain targeting /GponForm/diag_Form diagnostic endpoint, abusing diag_action=ping for command injection to download Mozi.m malware via wget, accompanied by images/ query artifact. Indicative of automated GPON router exploitation for Mozi botnet deployment.
| Date | Category | Protocol | Comment |
|---|---|---|---|
| Mar 2, 2026 | Brute Force | TELNET | SikkerGuard: 2 blocked packets |