IntrusionLabs IntrusionLabs
← Back to feed

130.94.99.47

TAGGED SUSPICIOUS how we decide →
Why: Network is on the Spamhaus ASN-DROP list, with 10 events seen by our sensors · certainty: inferred
Threat Confidence
51%
Assessment
SSH password brute-forcer
  • Logged in with 19 different credentials across 36 logins.
  • Downloaded 18 files and ran 54 commands on the host.
  • Part of a 260-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇲🇲 MM / Yangon
ASN
AS154177 · LIGHT NODE LIMITED
Cloud Provider
—
Total Events
524
Top 10% by volume
Agent Count
2
First / Last Seen
2026-10-01 23:10 — 2026-10-03 23:41
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
151 IPs 617795 events
2026-10-01 — ongoing · 151 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 695804 events
2026-10-01 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
256 IPs 838152 events
2026-09-21 — ongoing · 256 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 558440 events
2026-09-05 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 200350 events
2026-06-09 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
209 IPs 698355 events
2026-05-25 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 298128 events
2026-05-22 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 767752 events
2026-05-06 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
131 IPs 136621 events
2026-05-06 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 633469 events
2026-04-27 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
32 IPs 159201 events
2026-04-24 — ongoing · 32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
260 IPs 788883 events
2026-04-15 — ongoing · 260 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
224 IPs 645020 events
2026-04-15 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
234 IPs 716887 events
2026-04-15 — ongoing · 234 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 759893 events
2026-04-15 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
217 IPs 708401 events
2026-04-15 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
214 IPs 653306 events
2026-04-15 — ongoing · 214 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 693438 events
2026-04-15 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
110 IPs 486767 events
2026-03-31 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
134 IPs 209652 events
2026-03-21 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
131 IPs 546395 events
2026-03-18 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
11 IPs 6518 events
2026-03-18 — ongoing · 11 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
20 IPs 85093 events
2026-03-15 — ongoing · 20 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
241 IPs 788826 events
2026-03-09 — ongoing · 241 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
12 IPs 74812 events
2026-03-07 — ongoing · 12 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 754228 events
2026-03-06 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
145 IPs 222704 events
2026-03-03 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
67 IPs 78106 events
2026-03-02 — ongoing · 67 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 31879 events
2026-03-02 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
110 IPs 516800 events
2026-03-01 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
178 IPs 301988 events
2026-03-01 — ongoing · 178 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 677517 events
2026-03-01 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 560124 events
2026-02-26 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×18 credential_probe ×40 opportunistic_bruter ×18
Sessions
76 (36 with login)
Avg Depth Score
0.46
Commands Executed
54
Files Downloaded
18
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe 5b672d7a27f3 w4m_singapore_01 · 2026-10-03 23:41
1 20%
Loading events...
Opportunistic Bruter 50bc23074f3f w4m_singapore_01 · 2026-10-03 23:39
1 50%
Loading events...
Malware Dropper 8f128099c2dc w4m_singapore_01 · 2026-10-03 23:39
3 1 1 100%
Loading events...
Credential Probe 8c8293ab248e w4m_singapore_01 · 2026-10-03 23:39
1 20%
Loading events...
Opportunistic Bruter 9cc0a02fc55a w4m_singapore_01 · 2026-10-03 23:38
1 50%
Loading events...
Malware Dropper 1f6b2d7d9df0 w4m_singapore_01 · 2026-10-03 23:38
3 1 1 100%
Loading events...
Credential Probe 2e259dc08934 w4m_singapore_01 · 2026-10-03 23:38
1 20%
Loading events...
Credential Probe 2b73a7c3ba0e w4m_singapore_01 · 2026-10-03 23:36
1 20%
Loading events...
Credential Probe 871f4bb5b22c w4m_singapore_01 · 2026-10-03 23:34
1 20%
Loading events...
Malware Dropper dfe097783997 w4m_singapore_01 · 2026-10-03 23:33
3 1 1 100%
Loading events...
Opportunistic Bruter cb3d9f533249 w4m_singapore_01 · 2026-10-03 23:33
1 50%
Loading events...
Credential Probe 3d5accccfc61 w4m_singapore_01 · 2026-10-03 23:33
1 20%
Loading events...
Credential Probe bcef8c96db28 w4m_singapore_01 · 2026-10-03 23:31
1 20%
Loading events...
Credential Probe f112c0864b87 w4m_singapore_01 · 2026-10-03 23:29
1 20%
Loading events...
Credential Probe 21243e690180 w4m_singapore_01 · 2026-10-03 23:28
1 20%
Loading events...
Credential Probe 6d849c5c1025 w4m_singapore_01 · 2026-10-03 23:26
1 20%
Loading events...
Opportunistic Bruter 4ff1177f65f3 w4m_singapore_01 · 2026-10-03 23:24
1 50%
Loading events...
Malware Dropper dc580c22c191 w4m_singapore_01 · 2026-10-03 23:24
3 1 1 100%
Loading events...
Credential Probe 3d54d39ffca4 w4m_singapore_01 · 2026-10-03 23:24
1 20%
Loading events...
Credential Probe 1351620e7b4c w4m_singapore_01 · 2026-10-03 23:23
1 20%
Loading events...
Credential Probe 49513dc81065 w4m_singapore_01 · 2026-10-03 23:21
1 20%
Loading events...
Malware Dropper 18a100490c90 w4m_singapore_01 · 2026-10-03 23:19
3 1 1 100%
Loading events...
Opportunistic Bruter bd82986f8ceb w4m_singapore_01 · 2026-10-03 23:19
1 50%
Loading events...
Credential Probe 3ae9f80d03c6 w4m_singapore_01 · 2026-10-03 23:19
1 20%
Loading events...
Opportunistic Bruter 78ca869b1764 w4m_singapore_01 · 2026-10-03 23:18
1 50%
Loading events...
Malware Dropper 613722551e1f w4m_singapore_01 · 2026-10-03 23:18
3 1 1 100%
Loading events...
Credential Probe 854fc2b54f4b w4m_singapore_01 · 2026-10-03 23:18
1 20%
Loading events...
Credential Probe 0512800f662e w4m_singapore_01 · 2026-10-03 23:16
1 20%
Loading events...
Malware Dropper 0fe38872902b w4m_singapore_01 · 2026-10-03 23:15
3 1 1 100%
Loading events...
Opportunistic Bruter 1adadef42456 w4m_singapore_01 · 2026-10-03 23:15
1 50%
Loading events...
Credential Probe 6c0aac169fb2 w4m_singapore_01 · 2026-10-03 23:15
1 20%
Loading events...
Credential Probe a11a296ea1eb w4m_singapore_01 · 2026-10-03 23:13
1 20%
Loading events...
Opportunistic Bruter f84843f2aa6b w4m_singapore_01 · 2026-10-03 23:11
1 50%
Loading events...
Credential Probe 1a9290f26a18 w4m_singapore_01 · 2026-10-03 23:11
1 20%
Loading events...
Malware Dropper 4385b2e9354d w4m_singapore_01 · 2026-10-03 23:11
3 1 1 100%
Loading events...
Credential Probe 9f2a96933c77 w4m_singapore_01 · 2026-10-03 23:02
1 20%
Loading events...
Credential Probe 75679e2047b6 w4m_seattle_01 · 2026-10-01 23:44
1 20%
Loading events...
Malware Dropper b0743a143bda w4m_seattle_01 · 2026-10-01 23:42
3 1 1 100%
Loading events...
Opportunistic Bruter a4612111be8d w4m_seattle_01 · 2026-10-01 23:42
1 50%
Loading events...
Credential Probe 2db2576bf593 w4m_seattle_01 · 2026-10-01 23:42
1 20%
Loading events...
Malware Dropper f8cf6fa522cc w4m_seattle_01 · 2026-10-01 23:40
3 1 1 100%
Loading events...
Opportunistic Bruter b5d648e55f52 w4m_seattle_01 · 2026-10-01 23:40
1 50%
Loading events...
Credential Probe 8c499b08e1ff w4m_seattle_01 · 2026-10-01 23:40
1 20%
Loading events...
Malware Dropper bde9863be38d w4m_seattle_01 · 2026-10-01 23:38
3 1 1 100%
Loading events...
Opportunistic Bruter bfe70523bff4 w4m_seattle_01 · 2026-10-01 23:38
1 50%
Loading events...
Credential Probe 903089ed21d2 w4m_seattle_01 · 2026-10-01 23:38
1 20%
Loading events...
Malware Dropper a9247eb52e01 w4m_seattle_01 · 2026-10-01 23:37
3 1 1 100%
Loading events...
Opportunistic Bruter 14231798e613 w4m_seattle_01 · 2026-10-01 23:37
1 50%
Loading events...
Credential Probe ab73a9792203 w4m_seattle_01 · 2026-10-01 23:37
1 20%
Loading events...
Credential Probe 0e9b49ae36e2 w4m_seattle_01 · 2026-10-01 23:35
1 20%
Loading events...