IntrusionLabs IntrusionLabs
← Back to feed

137.255.13.181

TAGGED SUSPICIOUS how we decide →
Threat Confidence
51%
Location
🇧🇯 BJ / Cotonou
ASN
AS328228 · SOCIETE BENINOISE D'INFRASTRUCTURES NUMERIQUES
Cloud Provider
—
Total Events
504
Top 10% by volume
Agent Count
2
First / Last Seen
2026-07-26 17:39 — 2026-07-30 23:59
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1046
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
114 IPs 328388 events
2026-07-30 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
121 IPs 574505 events
2026-07-27 — ongoing · 121 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Subnet 137.255.13.0/24 SUBNET Ended high 🇧🇯 BJ
3 IPs 1765 events
ssh:bruteforce
2026-07-25 — ongoing · 3 IPs from the same /24 subnet (137.255.13.0/24) were observed attacking our sensors within the same time window. …
Multi-Agent Scan SCAN Active medium
131 IPs 637488 events
2026-07-17 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
94 IPs 252864 events
2026-07-12 — ongoing · 94 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
95 IPs 372779 events
2026-07-11 — ongoing · 95 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
107 IPs 365511 events
2026-07-02 — ongoing · 107 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
128 IPs 566036 events
2026-06-05 — ongoing · 128 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
90 IPs 312336 events
2026-05-03 — ongoing · 90 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
26 IPs 20814 events
2026-04-09 — ongoing · 26 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
75 IPs 299185 events
2026-04-09 — ongoing · 75 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
63 IPs 452621 events
2026-04-09 — ongoing · 63 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
97 IPs 505765 events
2026-04-09 — ongoing · 97 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
11 IPs 36252 events
2026-04-09 — ongoing · 11 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
126 IPs 535434 events
2026-04-09 — ongoing · 126 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
45 IPs 89191 events
2026-04-06 — ongoing · 45 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
130 IPs 424253 events
2026-03-26 — ongoing · 130 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
80 IPs 252927 events
2026-03-08 — ongoing · 80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
95 IPs 330225 events
2026-03-08 — ongoing · 95 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
79 IPs 227707 events
2026-03-04 — ongoing · 79 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
117 IPs 408850 events
2026-03-01 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
80 IPs 251750 events
2026-03-01 — ongoing · 80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 388291 events
2026-02-28 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 562142 events
2026-02-28 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
9 IPs 38310 events
2026-02-26 — ongoing · 9 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 3387 events
2026-02-26 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
101 IPs 324072 events
2026-02-24 — ongoing · 101 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
26 IPs 85665 events
2026-02-24 — ongoing · 26 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 malware_dropper ×18 credential_probe ×33 opportunistic_bruter ×19
Sessions
71 (37 with login)
Avg Depth Score
0.48
Commands Executed
54
Files Downloaded
18
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Scanner c32831747e99 w4m_seattle_01 · 2026-07-30 23:59
15%
Loading events...
Malware Dropper 3618e7affd83 w4m_seattle_01 · 2026-07-30 23:59
3 1 1 100%
Loading events...
Credential Probe aeb73d4b2fed w4m_seattle_01 · 2026-07-30 23:57
1 20%
Loading events...
Opportunistic Bruter f17957907c76 w4m_seattle_01 · 2026-07-30 23:54
1 50%
Loading events...
Credential Probe e5f6f476b6bc w4m_seattle_01 · 2026-07-30 23:54
1 20%
Loading events...
Opportunistic Bruter b98cd9cd6f65 w4m_seattle_01 · 2026-07-30 23:54
1 50%
Loading events...
Credential Probe 2249b57e7680 w4m_seattle_01 · 2026-07-30 23:52
1 20%
Loading events...
Credential Probe 5ebcb2e8eb68 w4m_seattle_01 · 2026-07-30 23:49
1 20%
Loading events...
Credential Probe bae04d1b6c9a w4m_seattle_01 · 2026-07-30 23:46
1 20%
Loading events...
Opportunistic Bruter 968d987da1f7 w4m_seattle_01 · 2026-07-30 23:44
1 50%
Loading events...
Malware Dropper 7792e3da0bd4 w4m_seattle_01 · 2026-07-30 23:44
3 1 1 100%
Loading events...
Credential Probe 80ec1a0c6a02 w4m_seattle_01 · 2026-07-30 23:44
1 20%
Loading events...
Opportunistic Bruter 1909c9910d3f w4m_seattle_01 · 2026-07-30 23:41
1 50%
Loading events...
Malware Dropper 9f1d00769256 w4m_seattle_01 · 2026-07-30 23:41
3 1 1 100%
Loading events...
Credential Probe 9baad8ab1bdb w4m_seattle_01 · 2026-07-30 23:41
1 20%
Loading events...
Credential Probe 5dde90d90ab1 w4m_seattle_01 · 2026-07-30 23:38
1 20%
Loading events...
Malware Dropper 690ca8249c3c w4m_seattle_01 · 2026-07-30 23:36
3 1 1 100%
Loading events...
Opportunistic Bruter 496f6d703448 w4m_seattle_01 · 2026-07-30 23:36
1 50%
Loading events...
Credential Probe 0ac6e2d477cb w4m_seattle_01 · 2026-07-30 23:36
1 20%
Loading events...
Opportunistic Bruter 8ecd01b1c602 w4m_seattle_01 · 2026-07-30 23:33
1 50%
Loading events...
Malware Dropper 22c6d5566cd4 w4m_seattle_01 · 2026-07-30 23:33
3 1 1 100%
Loading events...
Credential Probe f77f0d5120cf w4m_seattle_01 · 2026-07-30 23:33
1 20%
Loading events...
Credential Probe 87d631e0f7bc w4m_seattle_01 · 2026-07-30 23:31
1 20%
Loading events...
Opportunistic Bruter 067a7c773ffe w4m_seattle_01 · 2026-07-30 23:28
1 50%
Loading events...
Malware Dropper 687afae67e15 w4m_seattle_01 · 2026-07-30 23:28
3 1 1 100%
Loading events...
Credential Probe 7357f66ff90c w4m_seattle_01 · 2026-07-30 23:28
1 20%
Loading events...
Opportunistic Bruter 8aa4cd71ecce w4m_seattle_01 · 2026-07-30 23:25
1 50%
Loading events...
Malware Dropper 618241d110a2 w4m_seattle_01 · 2026-07-30 23:25
3 1 1 100%
Loading events...
Credential Probe 4af5deb2f2c5 w4m_seattle_01 · 2026-07-30 23:25
1 20%
Loading events...
Credential Probe 4fbd9dfd0889 w4m_seattle_01 · 2026-07-30 23:23
1 20%
Loading events...
Malware Dropper 246f22d65513 w4m_seattle_01 · 2026-07-30 23:20
3 1 1 100%
Loading events...
Opportunistic Bruter 924795742a81 w4m_seattle_01 · 2026-07-30 23:20
1 50%
Loading events...
Credential Probe 443d2cadedc5 w4m_seattle_01 · 2026-07-30 23:20
1 20%
Loading events...
Opportunistic Bruter 4fd0fdcf91d5 w4m_seattle_01 · 2026-07-30 23:18
1 50%
Loading events...
Malware Dropper 6f9659fd140f w4m_seattle_01 · 2026-07-30 23:18
3 1 1 100%
Loading events...
Credential Probe 6684935a7f74 w4m_seattle_01 · 2026-07-30 23:18
1 20%
Loading events...
Opportunistic Bruter b25e4d90b0c1 w4m_seattle_01 · 2026-07-30 23:15
1 50%
Loading events...
Malware Dropper 5fb86a7ee292 w4m_seattle_01 · 2026-07-30 23:15
3 1 1 100%
Loading events...
Credential Probe e7bb26fca810 w4m_seattle_01 · 2026-07-30 23:15
1 20%
Loading events...
Credential Probe b059243e7789 w4m_seattle_01 · 2026-07-30 23:12
1 20%
Loading events...
Credential Probe ac3ceb948a51 w4m_seattle_01 · 2026-07-30 23:10
1 20%
Loading events...
Credential Probe 8a5820c3166b w4m_seattle_01 · 2026-07-30 23:07
1 20%
Loading events...
Credential Probe b3586c8fd7f9 w4m_seattle_01 · 2026-07-30 23:05
1 20%
Loading events...
Opportunistic Bruter 4b5d2aa9faa5 w4m_seattle_01 · 2026-07-30 23:02
1 50%
Loading events...
Malware Dropper 9f45670eef76 w4m_seattle_01 · 2026-07-30 23:02
3 1 1 100%
Loading events...
Credential Probe 6a418bff095f w4m_seattle_01 · 2026-07-30 23:02
1 20%
Loading events...
Credential Probe e426bfc363ec w4m_seattle_01 · 2026-07-30 22:59
1 20%
Loading events...
Credential Probe 6744973d6a73 w4m_seattle_01 · 2026-07-30 22:57
1 20%
Loading events...
Opportunistic Bruter fd3d1d894e05 w4m_seattle_01 · 2026-07-30 22:54
1 50%
Loading events...
Malware Dropper 4c8a8bf6bb3e w4m_seattle_01 · 2026-07-30 22:54
3 1 1 100%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}