220.105.223.92.in-addr.arpa name = vps-lux.local.
Authoritative answers can be found from:
An obfuscated version of the t_file_wp 2nd stage backdoor
The same code, or nearly so, as the backdoor of /campaigns/campaignG/88.214.26.34-2019-05-28c
The obfuscation appears to be based on