IntrusionLabs IntrusionLabs
← Back to feed

151.243.236.107

mail.nfe3.contabilidadenf.lat (contabilidadenf.lat) ✗ FCrDNS
Threat Confidence
43%
Assessment
Port and service scanner
  • Ran 8 commands on the host.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇨🇦 CA / Beauharnois
ASN
AS16276 · OVH SAS
Cloud Provider
—
Total Events
46
Above average by volume
Agent Count
1
First / Last Seen
2026-09-29 10:06 — 2026-10-04 08:49
Attack Types
ftp:bruteforce ssh:connection ssh:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1046 T1082
Exfiltration
T1048
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×3 ftp_probe ×2 data_exfiltrator ×2
Sessions
7 (2 with login)
Avg Depth Score
0.38
Commands Executed
8
Files Downloaded
0
Notable Commands
  • uname -s 2>/dev/null
  • mkdir -p /var/www/html /var/www /usr/share/nginx/html 2>/dev/null; true
  • test -f '/var/www/html/dev-dandinho.php' && wc -c < '/var/www/html/dev-dandinho.php'
  • test -f '/var/www/dev-dandinho.php' && wc -c < '/var/www/dev-dandinho.php'
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
57e4cc8ee36c3d78f75c6a05acd55963
SSH Client
SSH-2.0-libssh2_1.11.1
Evidence Timeline
Data Exfiltrator 3b457b06450d newark_01 · 2026-10-04 08:48
4 1 90%
Loading events...
Scanner a004ce6304c5 newark_01 · 2026-10-04 06:37
15%
Loading events...
Scanner d3de666a52d1 newark_01 · 2026-10-04 01:04
15%
Loading events...
Data Exfiltrator 5576315156de newark_01 · 2026-10-01 12:43
4 1 90%
Loading events...
FTP Probe d32eb10add07d408 newark_01 · 2026-09-29 21:14
1 20%
Loading events...
FTP Probe a2b12c2c333369d1 newark_01 · 2026-09-29 21:14
1 20%
Loading events...
Scanner 4fa21b328af8 newark_01 · 2026-09-29 10:06
15%
Loading events...
Non-Session Events
Timestamp Port Proto Event Source Location
2026-09-29 21:14:48 :21 ftp FTP connection opencanary ewr
2026-09-29 21:14:48 :21 ftp FTP connection opencanary ewr