Brute force and worm IP address...

See: https://www.abuseipdb.com/check/222.186.15.246
Confirmed: https://viz.greynoise.io/ip/222.186.15.246
5 engines detect: https://www.virustotal.com/gui/url/c8992fbe379645bf04cb963592f2be01b60c2186730adebad2d3538881f8dbaa/details
6 detect on serving IP: https://www.virustotal.com/gui/ip-address/222.186.15.246/detection

Detection on domain and executables: https://www.virustotal.com/gui/ip-address/222.186.15.246/relations

polonus