IntrusionLabs IntrusionLabs
← Back to feed

146.190.74.52

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
thespire.cloud (thespire.cloud) ✗ FCrDNS
Threat Confidence
66%
Assessment
SSH password brute-forcer
  • Logged in with 17 different credentials across 32 logins.
  • Downloaded 16 files and ran 48 commands on the host.
  • Active for 8 days, 2026-09-30 to 2026-10-08.
  • Part of a 237-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US / North Bergen
ASN
AS14061 · DigitalOcean, LLC
Cloud Provider
DigitalOcean
Total Events
593
Top 10% by volume
Agent Count
3
First / Last Seen
2026-09-30 10:03 — 2026-10-08 14:16
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
194 IPs 739761 events
2026-10-05 — ongoing · 194 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
138 IPs 655733 events
2026-10-04 — ongoing · 138 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
160 IPs 787350 events
2026-10-04 — ongoing · 160 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
98 IPs 446905 events
2026-10-04 — ongoing · 98 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
123 IPs 562378 events
2026-10-02 — ongoing · 123 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
2 IPs 906 events
2026-09-30 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
167 IPs 748126 events
2026-09-29 — ongoing · 167 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 297685 events
2026-09-28 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
103 IPs 291261 events
2026-09-27 — ongoing · 103 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
189 IPs 752601 events
2026-09-24 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
180 IPs 645291 events
2026-09-24 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 807924 events
2026-09-24 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
192 IPs 685261 events
2026-09-24 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
63 IPs 77568 events
2026-09-20 — ongoing · 63 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 754492 events
2026-09-17 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
204 IPs 781973 events
2026-09-17 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
148 IPs 693781 events
2026-09-15 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 579416 events
2026-09-14 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
62 IPs 97864 events
2026-09-09 — ongoing · 62 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
31 IPs 106323 events
2026-09-09 — ongoing · 31 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
181 IPs 662175 events
2026-09-08 — ongoing · 181 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
209 IPs 678033 events
2026-09-07 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
215 IPs 885968 events
2026-09-06 — ongoing · 215 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
49 IPs 291608 events
2026-08-27 — ongoing · 49 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 567509 events
2026-06-28 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 609728 events
2026-06-28 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
151 IPs 543723 events
2026-06-09 — ongoing · 151 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
130 IPs 441876 events
2026-05-30 — ongoing · 130 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
22 IPs 37946 events
2026-04-25 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
219 IPs 636424 events
2026-04-20 — ongoing · 219 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 502817 events
2026-04-15 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
237 IPs 642363 events
2026-04-15 — ongoing · 237 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
22 IPs 26025 events
2026-04-15 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 715195 events
2026-04-15 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
172 IPs 686889 events
2026-04-15 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 683505 events
2026-04-15 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
19 IPs 67283 events
2026-04-15 — ongoing · 19 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
223 IPs 592213 events
2026-04-15 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 185332 events
2026-04-15 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
25 IPs 45442 events
2026-04-02 — ongoing · 25 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
175 IPs 409511 events
2026-03-21 — ongoing · 175 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 582231 events
2026-03-21 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
104 IPs 482943 events
2026-03-17 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
43 IPs 30724 events
2026-03-17 — ongoing · 43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
119 IPs 295899 events
2026-03-13 — ongoing · 119 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 545726 events
2026-03-10 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 162304 events
2026-03-09 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 491081 events
2026-03-09 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 573388 events
2026-03-09 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
196 IPs 731895 events
2026-03-05 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
169 IPs 642835 events
2026-03-04 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 564694 events
2026-03-03 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 676259 events
2026-03-03 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
222 IPs 671976 events
2026-03-03 — ongoing · 222 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
184 IPs 516960 events
2026-03-03 — ongoing · 184 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
185 IPs 645470 events
2026-03-03 — ongoing · 185 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 436503 events
2026-03-03 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 813756 events
2026-03-02 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
219 IPs 719314 events
2026-03-01 — ongoing · 219 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
150 IPs 730221 events
2026-03-01 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 786535 events
2026-03-01 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 315603 events
2026-02-28 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
203 IPs 722247 events
2026-02-27 — ongoing · 203 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×16 credential_probe ×61 opportunistic_bruter ×16
Sessions
93 (32 with login)
Avg Depth Score
0.39
Commands Executed
48
Files Downloaded
16
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Opportunistic Bruter 20a54dd6bdda newark_01 · 2026-10-08 14:16
1 50%
Loading events...
Malware Dropper d0e2b66874a9 newark_01 · 2026-10-08 14:16
3 1 1 100%
Loading events...
Credential Probe d2eaeddace04 newark_01 · 2026-10-08 14:16
1 20%
Loading events...
Credential Probe d76d4d559823 newark_01 · 2026-10-08 14:14
1 20%
Loading events...
Credential Probe 470dc12856a8 newark_01 · 2026-10-08 14:13
1 20%
Loading events...
Credential Probe b8c082af6276 newark_01 · 2026-10-08 14:12
1 20%
Loading events...
Credential Probe d5a6e1934abd newark_01 · 2026-10-08 14:11
1 20%
Loading events...
Malware Dropper d23bcc4cabf4 newark_01 · 2026-10-08 14:09
3 1 1 100%
Loading events...
Opportunistic Bruter 3f123d521ad3 newark_01 · 2026-10-08 14:09
1 50%
Loading events...
Credential Probe 3131a83e5136 newark_01 · 2026-10-08 14:09
1 20%
Loading events...
Malware Dropper adc478986698 newark_01 · 2026-10-08 14:08
3 1 1 100%
Loading events...
Opportunistic Bruter 28f0a6d93c39 newark_01 · 2026-10-08 14:08
1 50%
Loading events...
Credential Probe 97ab12812427 newark_01 · 2026-10-08 14:08
1 20%
Loading events...
Opportunistic Bruter d1b4d90db2c0 newark_01 · 2026-10-08 14:07
1 50%
Loading events...
Malware Dropper 348814525034 newark_01 · 2026-10-08 14:07
3 1 1 100%
Loading events...
Credential Probe e26e5011d4e7 newark_01 · 2026-10-08 14:07
1 20%
Loading events...
Credential Probe df6a465c8dce newark_01 · 2026-10-08 14:05
1 20%
Loading events...
Credential Probe 9d931fe37302 newark_01 · 2026-10-08 14:04
1 20%
Loading events...
Opportunistic Bruter bbfaeabb5864 newark_01 · 2026-10-08 14:03
1 50%
Loading events...
Malware Dropper 63e6233954f6 newark_01 · 2026-10-08 14:03
3 1 1 100%
Loading events...
Credential Probe 4dfec256faee newark_01 · 2026-10-08 14:03
1 20%
Loading events...
Credential Probe acdbcc7fb694 newark_01 · 2026-10-08 14:02
1 20%
Loading events...
Credential Probe 719faab63b50 newark_01 · 2026-10-08 14:00
1 20%
Loading events...
Credential Probe 4fe50f1f164d newark_01 · 2026-10-08 13:59
1 20%
Loading events...
Credential Probe 72d340ab28bf newark_01 · 2026-10-08 13:58
1 20%
Loading events...
Credential Probe 6c66248a91af newark_01 · 2026-10-08 13:57
1 20%
Loading events...
Malware Dropper 845b841fe74b newark_01 · 2026-10-08 13:55
3 1 1 100%
Loading events...
Opportunistic Bruter 1df062ed7fea newark_01 · 2026-10-08 13:55
1 50%
Loading events...
Credential Probe 283cd4d87001 newark_01 · 2026-10-08 13:55
1 20%
Loading events...
Credential Probe dedc4842cba7 newark_01 · 2026-10-08 13:54
1 20%
Loading events...
Credential Probe 34ad24c0ec0c newark_01 · 2026-10-08 13:53
1 20%
Loading events...
Credential Probe 404fe2031d8d newark_01 · 2026-10-08 13:44
1 20%
Loading events...
Credential Probe fb207251a34e w4m_seattle_01 · 2026-10-05 04:39
1 20%
Loading events...
Credential Probe 86b38a69a9d6 w4m_seattle_01 · 2026-10-05 04:38
1 20%
Loading events...
Credential Probe 3aa523f3fdf4 w4m_seattle_01 · 2026-10-05 04:36
1 20%
Loading events...
Malware Dropper 0e136cd43c78 w4m_seattle_01 · 2026-10-05 04:35
3 1 1 100%
Loading events...
Opportunistic Bruter bb8762d27586 w4m_seattle_01 · 2026-10-05 04:35
1 50%
Loading events...
Credential Probe 6856798eff80 w4m_seattle_01 · 2026-10-05 04:35
1 20%
Loading events...
Credential Probe 995c980ee64a w4m_seattle_01 · 2026-10-05 04:34
1 20%
Loading events...
Credential Probe e80a7301eeb7 w4m_seattle_01 · 2026-10-05 04:33
1 20%
Loading events...
Opportunistic Bruter 6b107bca8895 w4m_seattle_01 · 2026-10-05 04:31
1 50%
Loading events...
Malware Dropper ed736df53617 w4m_seattle_01 · 2026-10-05 04:31
3 1 1 100%
Loading events...
Credential Probe 0902a096ac47 w4m_seattle_01 · 2026-10-05 04:31
1 20%
Loading events...
Malware Dropper c22e0a8fbeaf w4m_seattle_01 · 2026-10-05 04:30
3 1 1 100%
Loading events...
Opportunistic Bruter cbbd000916f5 w4m_seattle_01 · 2026-10-05 04:30
1 50%
Loading events...
Credential Probe aabb6e124c8b w4m_seattle_01 · 2026-10-05 04:30
1 20%
Loading events...
Credential Probe d6ec567a78c8 w4m_seattle_01 · 2026-10-05 04:29
1 20%
Loading events...
Credential Probe 154b01fe69e6 w4m_seattle_01 · 2026-10-05 04:28
1 20%
Loading events...
Opportunistic Bruter 435badc46093 w4m_seattle_01 · 2026-10-05 04:27
1 50%
Loading events...
Malware Dropper 0cff73d59f1d w4m_seattle_01 · 2026-10-05 04:26
3 1 1 100%
Loading events...