Loading threats
SMB session creating and binding to the svcctl pipe, opening the Service Control Manager via OpenSCManagerW, creating a service with an mshta.exe VBScript payload, starting it via StartServiceW, then deleting it via DeleteService.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 27,060 | 1,891 | 🇵🇰 PK | AS138423 | 2026-04-09 |
| 223.123.38.37 | 100% | 16,394 | 2,093 | 🇵🇰 PK | AS138423 | 2026-04-08 |
| 223.123.38.39 | 100% | 13,388 | 1,986 | 🇵🇰 PK | AS138423 | 2026-04-07 |
| 112.54.12.215 | 100% | 2,167 | 1,797 | 🇨🇳 CN | AS56044 | 2026-03-20 |
| 217.219.214.34 | 99% | 1,059 | 1,005 | 🇮🇷 IR | AS58224 | 2026-02-25 |
| 178.210.34.74 | 98% | 566 | 543 | 🇷🇺 RU | AS43727 | 2026-04-09 |
| 77.82.80.88 | 100% | 451 | 350 | 🇷🇺 RU | AS34974 | 2026-03-02 |
| 46.99.149.37 | 92% | 424 | 401 | 🇽🇰 XK | AS21246 | 2026-04-09 |
| 78.187.146.68 | 98% | 390 | 287 | 🇹🇷 TR | AS9121 | 2026-02-24 |
| 111.61.77.252 | 93% | 366 | 343 | 🇨🇳 CN | AS24547 | 2026-04-09 |
| 43.251.255.204 | 91% | 206 | 183 | 🇵🇰 PK | AS136384 | 2026-04-05 |
| 85.237.63.7 | 91% | 205 | 182 | 🇷🇺 RU | AS12389 | 2026-04-06 |
| 41.129.52.246 | 100% | 198 | 114 | 🇪🇬 EG | AS24863 | 2026-04-01 |
| 74.112.114.170 | 95% | 185 | 185 | 🇺🇸 US | AS11525 | 2026-04-07 |
| 185.126.235.76 | 91% | 153 | 130 | 🇪🇸 ES | AS200845 | 2026-03-28 |
| 41.139.147.225 | 93% | 138 | 138 | 🇰🇪 KE | AS37061 | 2026-04-08 |
| 62.162.141.194 | 92% | 134 | 109 | 🇲🇰 MK | AS6821 | 2026-04-08 |
| 205.164.130.226 | 91% | 111 | 90 | 🇵🇰 PK | AS136384 | 2026-03-28 |
| 120.211.171.91 | 95% | 109 | 86 | 🇨🇳 CN | AS24547 | 2026-04-09 |
| 117.55.243.194 | 90% | 96 | 73 | 🇮🇳 IN | AS38625 | 2026-04-07 |