Seen two hours ago as RBN - danger level 2. https://www.mywot.com/en/scorecard/213.155.14.161
Missed by most av solutions: http://mtc.sri.com/live_data/cc_servers/
Client: GET /x.exe HTTP/1.0User-Agent: Mozilla/4.0Host: 5.248.186.15:6651
Server: GET /index.php?id=twhhwdrjtyidjsmp&scn=0&inf=0&ver=19&cnt=USA…
deny ip host 213.155.14.161 any log ! 37 infects 08/22/13 to 02/11/14 - SRI Malware Threat Center
Microsoft remote terminal, SSH, Telnet or shared desktops attacks.
On IP: https://www.virustotal.com/nl/ip-address/213.155.14.161/information/
Flagged here: http://urlquery.net/report.php?id=6567025
polonus