Loading threats
Direct invocation of the BusyBox multi-call binary (/bin/busybox) without specifying a subcommand. This pattern is commonly observed in automated shell sessions where the actor is verifying BusyBox availability, querying supported applets, or preparing to execute embedded utilities through BusyBox on constrained or embedded Linux systems.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 27,132 | 1,963 | 🇵🇰 PK | AS138423 | 2026-04-15 |
| 103.184.56.249 | 97% | 25,666 | 196 | 🇮🇩 ID | AS149667 | 2026-02-25 |
| 103.156.221.253 | 97% | 25,219 | 195 | 🇮🇩 ID | AS149667 | 2026-02-26 |
| 223.123.43.5 | 100% | 23,886 | 2,032 | 🇵🇰 PK | AS138423 | 2026-04-15 |
| 103.184.56.241 | 92% | 22,538 | 178 | 🇮🇩 ID | AS149667 | 2026-04-02 |
| 223.123.43.0 | 100% | 21,732 | 1,714 | 🇵🇰 PK | AS138423 | 2026-04-14 |
| 188.126.240.54 | 74% | 4,465 | 100 | 🇸🇪 SE | AS3301 | 2026-03-23 |
| 210.222.129.233 | 100% | 4,309 | 124 | 🇰🇷 KR | AS4766 | 2026-03-30 |
| 121.129.112.124 | 88% | 1,837 | 70 | 🇰🇷 KR | AS4766 | 2026-04-13 |
| 103.156.221.242 | 85% | 1,704 | 39 | 🇮🇩 ID | AS149667 | 2026-04-05 |
| 218.154.181.71 | 87% | 1,698 | 65 | 🇰🇷 KR | AS4766 | 2026-04-17 |
| 89.10.237.211 | 100% | 1,684 | 151 | 🇳🇴 NO | AS15659 | 2026-04-13 |
| 103.184.56.220 | 87% | 1,595 | 45 | 🇮🇩 ID | AS149667 | 2026-04-10 |
| 220.88.178.58 | 97% | 1,484 | 67 | 🇰🇷 KR | AS4766 | 2026-04-17 |
| 210.104.42.40 | 87% | 1,483 | 65 | 🇰🇷 KR | AS4766 | 2026-04-13 |
| 183.106.83.148 | 96% | 1,452 | 32 | 🇰🇷 KR | AS4766 | 2026-02-26 |
| 218.146.163.192 | 93% | 1,406 | 69 | 🇰🇷 KR | AS4766 | 2026-04-17 |
| 121.137.131.78 | 92% | 1,391 | 42 | 🇰🇷 KR | AS4766 | 2026-04-12 |
| 180.255.108.230 | 85% | 1,383 | 23 | 🇸🇬 SG | AS9506 | 2026-02-19 |
| 27.35.50.9 | 90% | 1,376 | 29 | 🇰🇷 KR | AS9762 | 2026-04-08 |