Redis Uppercase Config Set Dbfilename Exp So

Uses the Redis CONFIG SET dbfilename exp.so command to change the Redis database snapshot filename to exp.so, a technique commonly used to write a malicious shared object file to disk for later loading as a Redis module.

Observed IPs

248

Avg Confidence

61%

Protocol

REDIS

Top IPs by event count

IP Address	Risk	Events	Sessions	Country	ASN	Last Seen
36.112.94.94	84%	4,158	2,244	🇨🇳 CN	AS4847	2026-02-26
121.30.192.44	73%	1,020	400	🇨🇳 CN	AS4837	2026-04-05
124.236.108.172	89%	653	516	🇨🇳 CN	AS134760	2026-04-10
171.80.12.2	66%	208	180	🇨🇳 CN	AS151185	2026-03-04
8.148.205.29	79%	197	38	🇨🇳 CN	AS37963	2026-03-03
47.108.169.114	62%	183	126	🇨🇳 CN	AS37963	2026-04-07
209.38.249.252	81%	155	18	🇩🇪 DE	AS14061	2026-02-27
36.133.109.170	81%	151	15	🇨🇳 CN	AS9808	2026-02-25
14.103.250.91	67%	151	67	🇨🇳 CN	AS4811	2026-03-25
222.213.23.56	86%	134	134	🇨🇳 CN	AS139220	2026-04-10
106.75.218.39	75%	109	25	🇨🇳 CN	AS17621	2026-03-28
27.37.68.89	62%	95	95	🇨🇳 CN	AS17816	2026-03-31
113.105.105.179	80%	92	11	🇨🇳 CN	AS4134	2026-03-27
47.107.147.159	74%	91	25	🇨🇳 CN	AS37963	2026-04-03
47.116.163.71	70%	90	24	🇨🇳 CN	AS37963	2026-03-25
47.84.91.3	84%	90	22	🇸🇬 SG	AS45102	2026-03-17
107.174.52.27	77%	88	19	🇺🇸 US	AS36352	2026-03-01
111.228.0.112	79%	84	12	🇨🇳 CN	AS141679	2026-03-01
203.57.109.214	59%	83	32	🇨🇳 CN	AS58519	2026-04-08
219.140.87.232	74%	82	20	🇨🇳 CN	AS4134	2026-02-21