Loading threats
mshta.exe executing inline VBScript that spawns cmd.exe to iterate over host:port pairs and silently install remote .png-disguised MSI payloads via msiexec /i over HTTP
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 27,132 | 1,963 | 🇵🇰 PK | AS138423 | 2026-04-15 |
| 223.123.38.37 | 100% | 16,420 | 2,119 | 🇵🇰 PK | AS138423 | 2026-04-16 |
| 223.123.38.39 | 100% | 13,388 | 1,986 | 🇵🇰 PK | AS138423 | 2026-04-07 |
| 91.144.21.210 | 90% | 12,944 | 12,153 | 🇸🇾 SY | AS29256 | 2026-04-16 |
| 200.75.2.138 | 100% | 10,236 | 9,717 | 🇨🇱 CL | AS14259 | 2026-04-16 |
| 77.94.120.206 | 100% | 9,836 | 9,513 | 🇷🇺 RU | AS28812 | 2026-04-16 |
| 102.33.152.150 | 100% | 8,667 | 8,663 | 🇿🇦 ZA | AS327782 | 2026-04-14 |
| 62.4.63.1 | 100% | 6,804 | 6,804 | 🇲🇪 ME | AS43940 | 2026-04-16 |
| 85.223.233.38 | 100% | 5,334 | 4,902 | 🇺🇦 UA | AS15895 | 2026-04-16 |
| 77.79.184.78 | 100% | 4,722 | 4,722 | 🇷🇺 RU | AS24955 | 2026-04-16 |
| 197.248.83.74 | 97% | 3,504 | 3,334 | 🇰🇪 KE | AS37061 | 2026-03-27 |
| 46.200.144.41 | 97% | 3,322 | 3,209 | 🇺🇦 UA | AS6849 | 2026-03-24 |
| 111.67.132.204 | 100% | 3,298 | 3,294 | 🇯🇵 JP | AS7524 | 2026-04-16 |
| 202.137.3.112 | 100% | 3,282 | 3,282 | 🇮🇩 ID | AS9905 | 2026-04-16 |
| 27.72.82.54 | 100% | 2,613 | 2,613 | 🇻🇳 VN | AS7552 | 2026-04-16 |
| 117.4.83.132 | 97% | 2,443 | 2,250 | 🇻🇳 VN | AS7552 | 2026-03-29 |
| 120.253.69.83 | 99% | 2,414 | 2,414 | 🇨🇳 CN | AS9808 | 2026-04-16 |
| 102.33.152.138 | 97% | 2,250 | 2,204 | 🇿🇦 ZA | AS327782 | 2026-04-01 |
| 68.228.123.83 | 97% | 2,242 | 2,051 | 🇺🇸 US | AS22773 | 2026-04-01 |
| 112.54.12.215 | 100% | 2,171 | 1,801 | 🇨🇳 CN | AS56044 | 2026-04-10 |