Loading threats
Invocation of /bin/busybox echo with output redirection to a filesystem path (e.g., /tmp/.b) without visible content. This pattern is commonly used to create or truncate a hidden file as a staging marker, execution flag, or placeholder during automated payload deployment on Linux-based systems.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 26,234 | 1,065 | 🇵🇰 PK | AS138423 | 2026-03-02 |
| 103.184.56.249 | 97% | 25,666 | 196 | 🇮🇩 ID | AS149667 | 2026-02-25 |
| 103.156.221.253 | 97% | 25,219 | 195 | 🇮🇩 ID | AS149667 | 2026-02-26 |
| 103.184.56.241 | 97% | 22,537 | 177 | 🇮🇩 ID | AS149667 | 2026-02-23 |
| 103.224.125.60 | 93% | 5,022 | 37 | 🇮🇩 ID | AS150197 | 2026-02-09 |
| 188.126.240.54 | 76% | 4,464 | 99 | 🇸🇪 SE | AS3301 | 2026-02-28 |
| 182.191.71.74 | 94% | 1,943 | 42 | 🇵🇰 PK | AS17557 | 2026-02-02 |
| 121.129.112.124 | 88% | 1,811 | 44 | 🇰🇷 KR | AS4766 | 2026-03-01 |
| 103.156.221.242 | 91% | 1,695 | 30 | 🇮🇩 ID | AS149667 | 2026-03-01 |
| 218.154.181.71 | 87% | 1,670 | 37 | 🇰🇷 KR | AS4766 | 2026-03-02 |
| 103.184.56.220 | 84% | 1,592 | 42 | 🇮🇩 ID | AS149667 | 2026-02-19 |
| 210.104.42.40 | 88% | 1,455 | 37 | 🇰🇷 KR | AS4766 | 2026-03-02 |
| 220.88.178.58 | 98% | 1,453 | 36 | 🇰🇷 KR | AS4766 | 2026-03-01 |
| 183.106.83.148 | 96% | 1,452 | 32 | 🇰🇷 KR | AS4766 | 2026-02-26 |
| 121.141.169.15 | 86% | 1,436 | 20 | 🇰🇷 KR | AS4766 | 2026-02-08 |
| 180.255.108.230 | 85% | 1,383 | 23 | 🇸🇬 SG | AS9506 | 2026-02-19 |
| 121.137.131.78 | 86% | 1,378 | 29 | 🇰🇷 KR | AS4766 | 2026-03-02 |
| 27.35.50.9 | 87% | 1,365 | 18 | 🇰🇷 KR | AS9762 | 2026-03-01 |
| 119.179.250.117 | 85% | 1,362 | 25 | 🇨🇳 CN | AS4837 | 2026-02-03 |
| 103.156.221.241 | 92% | 1,340 | 15 | 🇮🇩 ID | AS149667 | 2026-02-01 |