Loading threats
mshta.exe executing inline VBScript that spawns cmd.exe to iterate over host:port pairs and silently install remote .png-disguised MSI payloads via msiexec /i over HTTP
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 26,234 | 1,065 | 🇵🇰 PK | AS138423 | 2026-03-02 |
| 223.123.38.37 | 100% | 15,460 | 1,159 | 🇵🇰 PK | AS138423 | 2026-03-03 |
| 223.123.38.39 | 100% | 12,645 | 1,243 | 🇵🇰 PK | AS138423 | 2026-03-02 |
| 77.94.120.206 | 100% | 5,849 | 5,528 | 🇷🇺 RU | AS28812 | 2026-03-03 |
| 91.144.21.210 | 100% | 5,470 | 4,977 | 🇸🇾 SY | AS29256 | 2026-03-03 |
| 200.75.2.138 | 100% | 5,232 | 4,713 | 🇨🇱 CL | AS14259 | 2026-03-03 |
| 102.33.152.150 | 98% | 4,748 | 4,744 | 🇿🇦 ZA | AS327782 | 2026-03-03 |
| 85.223.233.38 | 100% | 3,185 | 2,754 | 🇺🇦 UA | AS15895 | 2026-03-02 |
| 46.200.144.41 | 100% | 2,230 | 2,118 | 🇺🇦 UA | AS6849 | 2026-03-02 |
| 112.54.12.215 | 100% | 2,139 | 1,769 | 🇨🇳 CN | AS56044 | 2026-03-02 |
| 68.228.123.83 | 100% | 2,107 | 1,916 | 🇺🇸 US | AS22773 | 2026-03-01 |
| 46.172.90.13 | 100% | 1,910 | 1,542 | 🇺🇦 UA | AS212621 | 2026-02-07 |
| 197.57.21.250 | 96% | 1,805 | 1,805 | 🇪🇬 EG | AS8452 | 2026-02-25 |
| 217.13.216.84 | 100% | 1,730 | 1,427 | 🇷🇺 RU | AS12494 | 2026-02-17 |
| 152.70.144.244 | 100% | 1,694 | 1,398 | 🇺🇸 US | AS31898 | 2026-03-02 |
| 197.248.83.74 | 100% | 1,605 | 1,436 | 🇰🇪 KE | AS37061 | 2026-02-19 |
| 117.4.83.132 | 100% | 1,563 | 1,370 | 🇻🇳 VN | AS7552 | 2026-03-03 |
| 41.239.180.54 | 99% | 1,294 | 1,058 | 🇪🇬 EG | AS8452 | 2026-02-05 |
| 41.232.113.190 | 94% | 1,230 | 1,230 | 🇪🇬 EG | AS8452 | 2026-03-03 |
| 112.134.247.189 | 100% | 1,183 | 960 | 🇱🇰 LK | AS9329 | 2026-02-13 |