Loading threats
SMB session creating and binding to the svcctl pipe, opening the Service Control Manager via OpenSCManagerW, creating a service with an mshta.exe VBScript payload, starting it via StartServiceW, then deleting it via DeleteService.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 27,132 | 1,963 | 🇵🇰 PK | AS138423 | 2026-04-15 |
| 223.123.38.37 | 100% | 16,420 | 2,119 | 🇵🇰 PK | AS138423 | 2026-04-16 |
| 223.123.38.39 | 100% | 13,388 | 1,986 | 🇵🇰 PK | AS138423 | 2026-04-07 |
| 112.54.12.215 | 100% | 2,171 | 1,801 | 🇨🇳 CN | AS56044 | 2026-04-10 |
| 217.219.214.34 | 99% | 1,059 | 1,005 | 🇮🇷 IR | AS58224 | 2026-02-25 |
| 178.210.34.74 | 98% | 572 | 549 | 🇷🇺 RU | AS43727 | 2026-04-15 |
| 111.61.77.252 | 93% | 476 | 453 | 🇨🇳 CN | AS24547 | 2026-04-17 |
| 77.82.80.88 | 100% | 451 | 350 | 🇷🇺 RU | AS34974 | 2026-03-02 |
| 46.99.149.37 | 92% | 435 | 412 | 🇽🇰 XK | AS21246 | 2026-04-16 |
| 78.187.146.68 | 98% | 390 | 287 | 🇹🇷 TR | AS9121 | 2026-02-24 |
| 85.237.63.7 | 91% | 211 | 188 | 🇷🇺 RU | AS12389 | 2026-04-16 |
| 43.251.255.204 | 91% | 206 | 183 | 🇵🇰 PK | AS136384 | 2026-04-05 |
| 41.129.52.246 | 100% | 198 | 114 | 🇪🇬 EG | AS24863 | 2026-04-01 |
| 74.112.114.170 | 95% | 185 | 185 | 🇺🇸 US | AS11525 | 2026-04-07 |
| 185.126.235.76 | 91% | 153 | 130 | 🇪🇸 ES | AS200845 | 2026-03-28 |
| 62.162.141.194 | 92% | 143 | 118 | 🇲🇰 MK | AS6821 | 2026-04-11 |
| 41.139.147.225 | 93% | 141 | 141 | 🇰🇪 KE | AS37061 | 2026-04-13 |
| 205.164.130.226 | 91% | 111 | 90 | 🇵🇰 PK | AS136384 | 2026-03-28 |
| 114.34.249.199 | 96% | 109 | 86 | 🇹🇼 TW | AS3462 | 2026-04-12 |
| 120.211.171.91 | 95% | 109 | 86 | 🇨🇳 CN | AS24547 | 2026-04-09 |