Loading threats
Executes a continuous while true loop that polls system telemetry from /proc (/proc/meminfo, /proc/stat, /proc/version, /proc/uptime, /proc/loadavg, /proc/sys/fs/file-nr, /proc/sys/kernel/hostname, /proc/net/dev) along with df -l and who, emitting the marker ##Moba## each iteration. This pattern matches the automated system monitoring routine spawned by the MobaXterm SSH client after session initialization.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 206.189.82.6 | 100% | 279 | 279 | 🇸🇬 SG | AS14061 | 2026-03-15 |
| 185.20.12.97 | 70% | 228 | 68 | 🇸🇪 SE | AS44136 | 2026-02-25 |
| 131.161.142.254 | 83% | 55 | 55 | 🇧🇷 BR | AS263077 | 2026-03-07 |
| 177.129.222.128 | 60% | 45 | 45 | 🇧🇷 BR | AS271644 | 2026-03-08 |
| 151.242.11.252 | 76% | 39 | 39 | 🇭🇰 HK | AS212336 | 2026-03-07 |
| 141.11.246.235 | 55% | 32 | 32 | 🇳🇱 NL | AS43350 | 2026-02-22 |
| 82.24.200.48 | 76% | 20 | 20 | 🇺🇸 US | AS397423 | 2026-03-12 |
| 91.243.167.4 | 29% | 17 | 7 | 🇮🇷 IR | AS59573 | 2026-02-27 |
| 14.176.210.17 | 43% | 15 | 15 | 🇻🇳 VN | AS45899 | 2026-02-22 |
| 5.190.74.151 | 60% | 14 | 14 | 🇮🇷 IR | AS58224 | 2026-02-23 |
| 146.70.98.101 | 56% | 13 | 13 | 🇧🇷 BR | AS9009 | 2026-03-06 |
| 5.190.250.238 | 47% | 5 | 5 | 🇮🇷 IR | AS58224 | 2026-02-21 |
| 170.254.152.115 | 33% | 4 | 4 | 🇧🇷 BR | AS263077 | 2026-03-14 |
| 146.70.147.99 | 34% | 2 | 2 | 🇺🇸 US | AS9009 | 2026-03-06 |
| 171.251.233.170 | 35% | 2 | 2 | 🇻🇳 VN | AS7552 | 2026-02-18 |