Loading threats
Shell command rm -rf targeting one or more dot-prefixed relative paths (e.g., .ffaaxx, .d). This pattern indicates forced recursive removal of hidden artifacts within the current working directory and is commonly observed as cleanup activity following staged payload execution in automated Telnet-based compromise chains.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 223.123.38.36 | 100% | 26,234 | 1,065 | 🇵🇰 PK | AS138423 | 2026-03-02 |
| 103.184.56.249 | 97% | 25,666 | 196 | 🇮🇩 ID | AS149667 | 2026-02-25 |
| 103.156.221.253 | 97% | 25,219 | 195 | 🇮🇩 ID | AS149667 | 2026-02-26 |
| 103.184.56.241 | 97% | 22,537 | 177 | 🇮🇩 ID | AS149667 | 2026-02-23 |
| 158.94.208.69 | 100% | 19,800 | 19,673 | 🇩🇪 DE | AS202412 | 2026-02-22 |
| 114.33.12.13 | 99% | 9,051 | 225 | 🇹🇼 TW | AS3462 | 2026-03-03 |
| 195.178.110.241 | 100% | 6,183 | 5,592 | 🇧🇬 BG | AS48090 | 2026-02-20 |
| 103.224.125.60 | 93% | 5,022 | 37 | 🇮🇩 ID | AS150197 | 2026-02-09 |
| 116.41.81.52 | 93% | 2,906 | 57 | 🇰🇷 KR | AS17858 | 2026-02-28 |
| 85.130.237.235 | 86% | 2,596 | 25 | 🇮🇱 IL | AS6810 | 2026-02-15 |
| 103.156.221.242 | 91% | 1,695 | 30 | 🇮🇩 ID | AS149667 | 2026-03-01 |
| 103.184.56.220 | 84% | 1,592 | 42 | 🇮🇩 ID | AS149667 | 2026-02-19 |
| 119.179.250.117 | 85% | 1,362 | 25 | 🇨🇳 CN | AS4837 | 2026-02-03 |
| 103.156.221.241 | 92% | 1,340 | 15 | 🇮🇩 ID | AS149667 | 2026-02-01 |
| 82.42.209.185 | 85% | 1,074 | 14 | 🇬🇧 GB | AS5089 | 2026-02-26 |
| 111.220.67.53 | 86% | 1,025 | 13 | 🇦🇺 AU | AS9443 | 2026-02-25 |
| 39.37.156.143 | 90% | 959 | 6 | 🇵🇰 PK | AS17557 | 2026-02-04 |
| 39.37.167.240 | 90% | 958 | 6 | 🇵🇰 PK | AS17557 | 2026-01-31 |
| 109.196.219.116 | 85% | 958 | 12 | 🇷🇺 RU | AS50439 | 2026-03-01 |
| 195.154.182.97 | 83% | 956 | 10 | 🇫🇷 FR | AS12876 | 2026-03-01 |