Loading threats
Detects an automated FTP session performing credential probing, directory discovery, ASCII mode configuration, passive transfer negotiation, and staged upload of a photo_scr payload. This pattern is consistent with scripted web shell or content-stager deployment via compromised FTP credentials.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 125.124.0.46 | 100% | 40,112 | 2,619 | 🇨🇳 CN | AS58461 | 2026-02-08 |
| 125.34.171.202 | 100% | 14,585 | 1,396 | 🇨🇳 CN | AS4808 | 2026-02-12 |
| 60.205.150.186 | 100% | 11,613 | 1,258 | 🇨🇳 CN | AS37963 | 2026-02-26 |
| 116.21.172.22 | 99% | 10,522 | 695 | 🇨🇳 CN | AS4134 | 2026-02-08 |
| 115.78.225.181 | 99% | 8,281 | 542 | 🇻🇳 VN | AS7552 | 2026-02-27 |
| 116.21.173.1 | 100% | 6,836 | 449 | 🇨🇳 CN | AS4134 | 2026-02-02 |
| 113.172.64.236 | 100% | 6,079 | 396 | 🇻🇳 VN | AS45899 | 2026-02-08 |
| 103.97.177.230 | 99% | 5,777 | 447 | 🇭🇰 HK | AS401696 | 2026-02-17 |
| 124.226.219.166 | 100% | 5,390 | 952 | 🇨🇳 CN | AS137693 | 2026-03-01 |
| 47.98.170.47 | 100% | 4,898 | 1,198 | 🇨🇳 CN | AS37963 | 2026-02-18 |
| 111.253.215.120 | 100% | 3,896 | 254 | 🇹🇼 TW | AS3462 | 2026-02-03 |
| 116.21.172.239 | 99% | 3,284 | 212 | 🇨🇳 CN | AS4134 | 2026-02-08 |
| 124.71.169.147 | 99% | 3,073 | 243 | 🇨🇳 CN | AS55990 | 2026-02-13 |
| 39.98.232.38 | 99% | 2,875 | 186 | 🇨🇳 CN | AS37963 | 2026-02-07 |
| 121.177.27.248 | 100% | 2,465 | 244 | 🇰🇷 KR | AS4766 | 2026-02-20 |
| 5.2.124.162 | 100% | 2,346 | 323 | 🇬🇧 GB | AS31655 | 2026-02-24 |
| 186.136.110.4 | 99% | 1,864 | 172 | 🇦🇷 AR | AS7303 | 2026-02-19 |
| 203.162.235.45 | 99% | 1,724 | 115 | 🇻🇳 VN | AS45899 | 2026-02-09 |
| 60.190.242.29 | 99% | 1,697 | 244 | 🇨🇳 CN | AS4134 | 2026-02-22 |
| 223.15.242.2 | 99% | 1,541 | 153 | 🇨🇳 CN | AS132153 | 2026-02-17 |