ctrlINT What the industry said about every indicator, with the quote

91.92.40[.]118IP address

Reported by 2 independent sources · first reported by Fortinet Threat Research · last reported

Last reported 2 months ago

What the reports say

2 reports, newest first · the exact sentence from each

  1. “All payload callbacks for these exploitation attempts pointed to the same loader URL at 91.92.40[.]118/wget.sh, linked to Evooo1Bot.”

    Infosecurity MagazineNews
    New Mirai-Based Linux Botnet ‘Evooo1Bot’ Turns Victims Into Proxies

  2. “…bserved active exploitation attempts targeting a range of edge devices, with all payload callbacks pointing to the same loader URL at 91.92.40[.]118/wget.sh.”

    Fortinet Threat ResearchVendor
    Multi-Functional Linux Botnet “Evooo1Bot”

Indicators reported together

named in the same reports
Copy these 2 indicators · defanged

Also named with it: CVE-2018-14558, CVE-2007-3010, CVE-2016-6277, CVE-2019-14931, CVE-2020-10987, CVE-2021-46422, CVE-2022-37055, CVE-2024-29269, CVE-2025-10123, CVE-2025-55583, CVE-2024-4577, CVE-2021-36260, CVE-2023-34362, CVE-2022-26134, CVE-2022-29464, CVE-2022-30525, CVE-2023-1389, CVE-2024-10914

Thanks — we review every report.

Report a wrong value
What is wrong with 91.92.40[.]118 here?
No account needed. We do not store your IP address.