IntrusionLabs IntrusionLabs
← Back to feed

13.83.166.246

TAGGED MALICIOUS how we decide →
Threat Confidence
57%
Location
🇺🇸 US / San Jose
ASN
AS8075 · Microsoft Corporation
Cloud Provider
Microsoft Azure
Total Events
156
Above average by volume
Agent Count
1
First / Last Seen
2026-05-07 15:13 — 2026-05-07 15:31
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Initial Access
T1078
Credential Access
T1110 T1110.001 T1552.003
Discovery
T1016 T1082 T1083
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-05-07 17:01
blocklist_de:reported
Campaigns
Not associated with any campaigns
Session Forensics
malware_dropper ×6
Sessions
6 (6 with login)
Avg Depth Score
1.0
Commands Executed
108
Files Downloaded
6
Notable Commands
  • echo "===HOSTNAME==="; hostname 2>/dev/null || echo EMPTY;; echo "===UNAME==="; uname -a 2>/dev/null || echo EMPTY;; echo "===WHOAMI==="; whoami 2>/dev/null || echo EMPTY;; echo "===PWD==="; pwd 2>/dev/null || echo EMPTY;; echo "===LS_ROOT==="; ls -la / 2>/dev/null | head -10 || echo EMPTY;; echo "===PS==="; ps aux 2>/dev/null | head -15 || echo EMPTY;; echo "===NETSTAT==="; netstat -tulpn 2>/dev/null | head -10 || echo EMPTY;; echo "===HISTORY==="; history 2>/dev/null | tail -5 || echo EMPTY;; echo "===SSH_VERSION==="; ssh -V 2>&1 || echo EMPTY;; echo "===UPTIME==="; uptime 2>/dev/null || echo EMPTY;; echo "===MOUNT==="; mount 2>/dev/null | head -5 || echo EMPTY;; echo "===ENV==="; env 2>/dev/null | head -10 || echo EMPTY;; echo "===CPU_CORES==="; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo 0;; echo "===ARCH==="; uname -m 2>/dev/null || echo unknown;; echo "===CPU_MODEL==="; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1 | cut -d ':' -f2- | sed 's/^ *//' || echo unknown;; echo "===RESOURCES==="; echo MEMKB=$(awk '/MemTotal/{print $2}' /proc/meminfo 2>/dev/null) DISKKB=$(df / 2>/dev/null | awk 'NR==2{print $2}') USERCNT=$(wc -l < /etc/passwd 2>/dev/null) PKGCNT=$(dpkg -l 2>/dev/null | grep -c '^ii' || rpm -qa 2>/dev/null | wc -l || echo 0);; echo "===CONTAINER==="; cat /proc/1/cgroup 2>/dev/null | head -3; test -f /.dockerenv && echo DOCKERENV; test -f /run/.containerenv && echo CONTAINERENV; echo;; echo "===COWRIE==="; ls /opt/cowrie /home/richard /etc/cowrie 2>&1;; echo "===DMESG==="; dmesg 2>/dev/null | head -5 || echo EMPTY;; echo "===PORTS==="; ss -tulpn 2>/dev/null | grep LISTEN | head -20 || netstat -tulpn 2>/dev/null | grep LISTEN | head -20 || echo EMPTY;; echo "===NETCFG==="; ls -la /etc/network/interfaces /etc/sysconfig/network-scripts/ /etc/netplan/ 2>/dev/null | head -3 || echo EMPTY;; echo "===IPADDR==="; ip addr show 2>/dev/null | grep -E '^[0-9]+:' | head -5 || echo EMPTY;; echo "===IPROUTE==="; ip route show 2>/dev/null | head -3 || echo EMPTY;; echo "===WRITE==="; TF=/tmp/t_$$; echo test > $TF 2>&1 && echo WRITEOK && rm -f $TF || echo WRITEFAIL;; echo "===IDCHECK==="; id 2>/dev/null && echo IDOK || echo IDFAIL; whoami 2>/dev/null && echo WHOAMIOK || echo WHOAMIFAIL;; echo "===PKGMGR==="; which apt 2>/dev/null || which yum 2>/dev/null || which pacman 2>/dev/null || which zypper 2>/dev/null || echo NOPKG;; echo "===SERVICES==="; systemctl list-units --type=service --state=running 2>/dev/null | head -10 || echo NOSVC;; echo "===SOCKETS==="; ss -tuln 2>/dev/null | wc -l || echo 0;; echo "===GPU==="; nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader 2>/dev/null || echo NOGPU;; echo "===MAXDISK==="; df -BG 2>/dev/null | awk 'NR>1{gsub("G","",$2); if($2+0>max) max=$2+0} END{print max+0}' || echo 0;; echo "===END==="
  • awk /MemTotal/{print $2} /proc/meminfo 2 > /dev/null
  • df / 2 > /dev/null | awk NR==2{print $2}
  • wc -l < /etc/passwd 2 > /dev/null
  • dpkg -l 2 > /dev/null | grep -c ^ii
  • dpkg -l
  • rpm -qa 2 > /dev/null | wc -l
  • rpm -qa
  • echo 0
  • sed s/^ *//
Fingerprints
HASSH
41436928ad6c56162ccacb243cee8297
SSH Client
SSH-2.0-Go
Evidence Timeline
Malware Dropper be8d4a6a09a2 w4m_seattle_01 · 2026-05-07 15:31
18 1 1 100%
Loading events...
Malware Dropper f1af1a106720 w4m_seattle_01 · 2026-05-07 15:31
18 1 1 100%
Loading events...
Malware Dropper 351fbf7c6ecc w4m_seattle_01 · 2026-05-07 15:29
18 1 1 100%
Loading events...
Malware Dropper 75e87704eeb1 w4m_seattle_01 · 2026-05-07 15:27
18 1 1 100%
Loading events...
Malware Dropper c6962230eb88 w4m_seattle_01 · 2026-05-07 15:25
18 1 1 100%
Loading events...
Malware Dropper 36d9df2cdef9 w4m_seattle_01 · 2026-05-07 15:13
18 1 1 100%
Loading events...