Loading threats
Sets a Redis-backed cron entry named backup4 with a 5-minute execution interval that uses wd1 -q -O- (wget-variant typo masquerading as wget) to fetch a remote payload over HTTP and pipe it directly into sh, indicating automated remote code execution and cron-based persistence.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 97.74.92.144 | 100% | 1,781 | 843 | 🇺🇸 US | AS26496 | 2026-04-16 |
| 157.230.101.158 | 100% | 1,492 | 734 | 🇺🇸 US | AS14061 | 2026-04-17 |
| 74.50.81.220 | 100% | 1,285 | 214 | 🇺🇸 US | AS19318 | 2026-03-31 |
| 138.68.169.168 | 100% | 1,047 | 214 | 🇬🇧 GB | AS14061 | 2026-03-09 |
| 84.247.137.164 | 100% | 881 | 107 | 🇫🇷 FR | AS51167 | 2026-02-23 |
| 143.198.113.180 | 83% | 879 | 79 | 🇺🇸 US | AS14061 | 2026-02-21 |
| 20.197.32.228 | 100% | 738 | 196 | 🇮🇳 IN | AS8075 | 2026-03-09 |
| 31.210.36.192 | 92% | 645 | 53 | 🇹🇷 TR | AS212219 | 2026-02-24 |
| 20.52.250.139 | 98% | 575 | 50 | 🇩🇪 DE | AS8075 | 2026-02-25 |
| 157.245.229.234 | 100% | 347 | 347 | 🇺🇸 US | AS14061 | 2026-04-16 |
| 20.235.199.173 | 96% | 317 | 114 | 🇮🇳 IN | AS8075 | 2026-04-16 |
| 20.175.198.133 | 100% | 269 | 267 | 🇨🇦 CA | AS8075 | 2026-04-17 |
| 20.175.205.56 | 100% | 269 | 269 | 🇨🇦 CA | AS8075 | 2026-04-15 |
| 61.240.139.28 | 100% | 267 | 267 | 🇨🇳 CN | AS4837 | 2026-04-16 |
| 161.35.120.3 | 100% | 244 | 244 | 🇺🇸 US | AS14061 | 2026-03-21 |
| 85.239.245.254 | 67% | 241 | 41 | 🇺🇸 US | AS40021 | 2026-03-03 |
| 20.116.232.29 | 99% | 235 | 233 | 🇨🇦 CA | AS8075 | 2026-04-15 |
| 49.7.204.85 | 100% | 228 | 228 | 🇨🇳 CN | AS23724 | 2026-04-17 |
| 20.207.238.171 | 100% | 207 | 207 | 🇮🇳 IN | AS8075 | 2026-04-17 |
| 51.77.47.129 | 95% | 204 | 202 | 🇵🇱 PL | AS16276 | 2026-04-17 |