IntrusionLabs IntrusionLabs
← Back to feed

103.216.170.145

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
49%
Assessment
SSH password brute-forcer
  • Logged in with 6 different credentials across 10 logins.
  • Downloaded 5 files and ran 15 commands on the host.
  • Part of a 236-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇮🇳 IN
ASN
AS135198 · Bombay Bullion Commmunication
Cloud Provider
—
Total Events
195
Above average by volume
Agent Count
2
First / Last Seen
2026-10-08 17:22 — 2026-10-09 01:09
Attack Types
ssh:bruteforce ssh:connection ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1046
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
2 IPs 371 events
2026-10-05 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
6 IPs 23138 events
2026-10-05 — ongoing · 6 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
98 IPs 446905 events
2026-10-04 — ongoing · 98 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
33 IPs 262242 events
2026-10-04 — ongoing · 33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
138 IPs 655733 events
2026-10-04 — ongoing · 138 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
3 IPs 524 events
2026-10-03 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
70 IPs 206660 events
2026-10-01 — ongoing · 70 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
174 IPs 979030 events
2026-09-30 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
167 IPs 748126 events
2026-09-29 — ongoing · 167 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Subnet 103.216.170.0/24 SUBNET Ended high 🇮🇳 IN
3 IPs 478 events
ssh:bruteforcessh:connectionssh:malware
2026-09-26 — ongoing · 3 IPs from the same /24 subnet (103.216.170.0/24) were observed attacking our sensors within the same time window. …
Multi-Agent Scan SCAN Active medium
43 IPs 96397 events
2026-09-25 — ongoing · 43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 807924 events
2026-09-24 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
168 IPs 858558 events
2026-09-24 — ongoing · 168 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
114 IPs 317864 events
2026-09-24 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 645291 events
2026-09-24 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
63 IPs 152957 events
2026-09-16 — ongoing · 63 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
148 IPs 693781 events
2026-09-15 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
106 IPs 577606 events
2026-09-14 — ongoing · 106 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
34 IPs 66132 events
2026-09-14 — ongoing · 34 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
120 IPs 240939 events
2026-09-10 — ongoing · 120 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
31 IPs 106323 events
2026-09-09 — ongoing · 31 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
114 IPs 513557 events
2026-08-22 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
137 IPs 748558 events
2026-08-09 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
22 IPs 37946 events
2026-04-25 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 938881 events
2026-04-23 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
236 IPs 1150481 events
2026-04-10 — ongoing · 236 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
4 IPs 599 events
2026-03-22 — ongoing · 4 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
16 IPs 49135 events
2026-03-17 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 482943 events
2026-03-17 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
196 IPs 731895 events
2026-03-05 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
171 IPs 724955 events
2026-03-05 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
169 IPs 642835 events
2026-03-04 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 676259 events
2026-03-03 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
6 IPs 1267 events
2026-02-26 — ongoing · 6 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
22 IPs 56456 events
2026-02-26 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×2 malware_dropper ×5 credential_probe ×19 opportunistic_bruter ×5
Sessions
31 (10 with login)
Avg Depth Score
0.37
Commands Executed
15
Files Downloaded
5
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe a8f5e2390f2a w4m_seattle_01 · 2026-10-09 01:09
1 20%
Loading events...
Credential Probe 7d810fad20c7 w4m_seattle_01 · 2026-10-09 01:07
1 20%
Loading events...
Opportunistic Bruter a77990bace89 w4m_seattle_01 · 2026-10-09 01:06
1 50%
Loading events...
Malware Dropper 1cdfe37d0968 w4m_seattle_01 · 2026-10-09 01:06
3 1 1 100%
Loading events...
Credential Probe 2428f3afa10f w4m_seattle_01 · 2026-10-09 01:06
1 20%
Loading events...
Scanner ac127e5d6c02 w4m_seattle_01 · 2026-10-09 01:04
15%
Loading events...
Opportunistic Bruter ec1e4507d236 w4m_seattle_01 · 2026-10-09 01:03
1 50%
Loading events...
Malware Dropper 106c17f51461 w4m_seattle_01 · 2026-10-09 01:03
3 1 1 100%
Loading events...
Credential Probe 2145bc573209 w4m_seattle_01 · 2026-10-09 01:03
1 20%
Loading events...
Scanner 894c04dad01f w4m_seattle_01 · 2026-10-09 01:01
15%
Loading events...
Credential Probe 93796cfa655f w4m_seattle_01 · 2026-10-09 01:00
1 20%
Loading events...
Credential Probe 260857f83cfb w4m_seattle_01 · 2026-10-09 00:58
1 20%
Loading events...
Opportunistic Bruter 325fae444634 w4m_seattle_01 · 2026-10-09 00:57
1 50%
Loading events...
Malware Dropper 9c66205476d2 w4m_seattle_01 · 2026-10-09 00:57
3 1 1 100%
Loading events...
Credential Probe ab78f6372fd7 w4m_seattle_01 · 2026-10-09 00:57
1 20%
Loading events...
Credential Probe 197ad2d77e9c w4m_seattle_01 · 2026-10-09 00:55
1 20%
Loading events...
Credential Probe 2633665c5ea1 w4m_seattle_01 · 2026-10-09 00:54
1 20%
Loading events...
Credential Probe ec196e107ad3 w4m_seattle_01 · 2026-10-09 00:52
1 20%
Loading events...
Credential Probe 60d2a0684cd7 w4m_seattle_01 · 2026-10-09 00:51
1 20%
Loading events...
Credential Probe c8a3d2cfbc40 w4m_seattle_01 · 2026-10-09 00:49
1 20%
Loading events...
Credential Probe 097f6ab2c7e2 w4m_seattle_01 · 2026-10-09 00:48
1 20%
Loading events...
Credential Probe f54c6a5cad8a w4m_seattle_01 · 2026-10-09 00:46
1 20%
Loading events...
Credential Probe e36791fe5c96 w4m_seattle_01 · 2026-10-09 00:45
1 20%
Loading events...
Credential Probe 03b1ae926925 w4m_seattle_01 · 2026-10-09 00:43
1 20%
Loading events...
Opportunistic Bruter f11bed9e7b5f w4m_seattle_01 · 2026-10-09 00:42
1 50%
Loading events...
Malware Dropper 3bc1e72ea862 w4m_seattle_01 · 2026-10-09 00:42
3 1 1 100%
Loading events...
Credential Probe 83436a0da64f w4m_seattle_01 · 2026-10-09 00:42
1 20%
Loading events...
Credential Probe 500c9e88109a w4m_seattle_01 · 2026-10-09 00:33
1 20%
Loading events...
Opportunistic Bruter 8cc5657a354e newark_01 · 2026-10-08 17:22
1 50%
Loading events...
Malware Dropper 11bb8e2a057f newark_01 · 2026-10-08 17:22
3 1 1 100%
Loading events...
Credential Probe c0bbdb73c138 newark_01 · 2026-10-08 17:22
1 20%
Loading events...