IntrusionLabs IntrusionLabs
← Back to feed

152.52.15.213

TAGGED SUSPICIOUS how we decide →
Threat Confidence
73%
Location
🇮🇳 IN
ASN
AS9498 · BHARTI Airtel Ltd.
Cloud Provider
—
Total Events
780
Top 10% by volume
Agent Count
3
First / Last Seen
2026-07-01 00:28 — 2026-07-11 15:22
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1046
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-07-17 20:03
blocklist_de:reported
Campaigns
Multi-Agent Scan SCAN Active medium
10 IPs 5684 events
2026-06-25 — ongoing · 10 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
33 IPs 86688 events
2026-06-21 — ongoing · 33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
27 IPs 13347 events
2026-06-12 — ongoing · 27 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
22 IPs 20645 events
2026-05-21 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 78448 events
2026-05-18 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
152 IPs 243846 events
2026-05-18 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
176 IPs 364571 events
2026-05-18 — ongoing · 176 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 286853 events
2026-05-18 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
143 IPs 91736 events
2026-05-18 — ongoing · 143 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
178 IPs 298288 events
2026-05-18 — ongoing · 178 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
57 IPs 114728 events
2026-05-18 — ongoing · 57 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
89 IPs 141143 events
2026-05-18 — ongoing · 89 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
63 IPs 98481 events
2026-05-18 — ongoing · 63 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
59 IPs 70266 events
2026-05-15 — ongoing · 59 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 274780 events
2026-05-14 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
45 IPs 48428 events
2026-05-14 — ongoing · 45 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
24 IPs 20379 events
2026-05-14 — ongoing · 24 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
81 IPs 126985 events
2026-05-13 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
20 IPs 20449 events
2026-05-10 — ongoing · 20 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 151899 events
2026-05-10 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
46 IPs 206783 events
2026-05-10 — ongoing · 46 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
154 IPs 357137 events
2026-05-08 — ongoing · 154 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
162 IPs 359798 events
2026-05-08 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
87 IPs 73393 events
2026-05-08 — ongoing · 87 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
8 IPs 7507 events
2026-05-08 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
145 IPs 299389 events
2026-05-05 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 221675 events
2026-05-05 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
135 IPs 278843 events
2026-05-05 — ongoing · 135 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
131 IPs 132873 events
2026-05-05 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
26 IPs 10208 events
2026-05-05 — ongoing · 26 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
11 IPs 8004 events
2026-05-05 — ongoing · 11 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 9790 events
2026-05-03 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
42 IPs 38621 events
2026-05-03 — ongoing · 42 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
150 IPs 355583 events
2026-05-03 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
146 IPs 252571 events
2026-04-11 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
65 IPs 44240 events
2026-03-30 — ongoing · 65 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 244562 events
2026-03-28 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
17 IPs 17344 events
2026-03-21 — ongoing · 17 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
20 IPs 13379 events
2026-03-21 — ongoing · 20 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
199 IPs 445779 events
2026-03-10 — ongoing · 199 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
204 IPs 277247 events
2026-03-10 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
155 IPs 490811 events
2026-03-10 — ongoing · 155 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
120 IPs 154031 events
2026-03-10 — ongoing · 120 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
6 IPs 6307 events
2026-03-09 — ongoing · 6 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
160 IPs 226591 events
2026-03-07 — ongoing · 160 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 352463 events
2026-03-06 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
102 IPs 233117 events
2026-03-06 — ongoing · 102 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
35 IPs 80847 events
2026-03-06 — ongoing · 35 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
157 IPs 267902 events
2026-03-06 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
155 IPs 370441 events
2026-03-06 — ongoing · 155 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
38 IPs 93001 events
2026-03-06 — ongoing · 38 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
38 IPs 34430 events
2026-03-05 — ongoing · 38 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
8 IPs 5098 events
2026-03-04 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
25 IPs 22930 events
2026-03-04 — ongoing · 25 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
8 IPs 4453 events
2026-03-04 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
160 IPs 318107 events
2026-03-02 — ongoing · 160 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
168 IPs 321880 events
2026-02-27 — ongoing · 168 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
85 IPs 128851 events
2026-02-27 — ongoing · 85 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
46 IPs 22841 events
2026-02-26 — ongoing · 46 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (511 IPs, 73 countries) HASSH Active high 🇺🇸 US
511 IPs 421963 events
ssh:bruteforce
2026-02-25 — ongoing · 511 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Microsoft Corporation (AS8075). Geographic and …
Multi-Agent Scan SCAN Active medium
138 IPs 215586 events
2026-02-24 — ongoing · 138 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 273556 events
2026-02-24 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
40 IPs 100084 events
2026-02-22 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 malware_dropper ×16 credential_probe ×51 opportunistic_bruter ×15
Sessions
83 (31 with login)
Avg Depth Score
0.41
Commands Executed
48
Files Downloaded
16
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe af40482a2a44 newark_01 · 2026-07-11 15:21
1 20%
Loading events...
Credential Probe f854e5dd5957 newark_01 · 2026-07-11 15:20
1 20%
Loading events...
Scanner 26bde7e78823 newark_01 · 2026-07-11 15:18
15%
Loading events...
Credential Probe c2e1819ff8f5 newark_01 · 2026-07-11 15:18
1 20%
Loading events...
Malware Dropper 7db046e35c96 newark_01 · 2026-07-11 15:18
3 1 1 100%
Loading events...
Credential Probe 6dec9276d1c8 newark_01 · 2026-07-11 15:16
1 20%
Loading events...
Opportunistic Bruter 78bf6317e061 newark_01 · 2026-07-11 15:14
1 50%
Loading events...
Malware Dropper 774f59dbcbeb newark_01 · 2026-07-11 15:14
3 1 1 100%
Loading events...
Credential Probe 41ffcbec682b newark_01 · 2026-07-11 15:14
1 20%
Loading events...
Credential Probe 1bd206c44ba6 newark_01 · 2026-07-11 15:12
1 20%
Loading events...
Opportunistic Bruter 9342b33679cf newark_01 · 2026-07-11 15:10
1 50%
Loading events...
Malware Dropper 99ada2fecd64 newark_01 · 2026-07-11 15:10
3 1 1 100%
Loading events...
Credential Probe 7be4f3fef932 newark_01 · 2026-07-11 15:10
1 20%
Loading events...
Credential Probe 3e19bcf674ae newark_01 · 2026-07-11 15:08
1 20%
Loading events...
Credential Probe f01517a1b054 newark_01 · 2026-07-11 15:06
1 20%
Loading events...
Malware Dropper 52d09ed9dea4 newark_01 · 2026-07-11 15:04
3 1 1 100%
Loading events...
Opportunistic Bruter 00b685bc6edf newark_01 · 2026-07-11 15:04
1 50%
Loading events...
Credential Probe 21dbb6e15b12 newark_01 · 2026-07-11 15:04
1 20%
Loading events...
Credential Probe 893dab05fabc newark_01 · 2026-07-11 15:02
1 20%
Loading events...
Opportunistic Bruter d3343c3a2d71 newark_01 · 2026-07-11 15:01
1 50%
Loading events...
Malware Dropper 27cc3e3525cc newark_01 · 2026-07-11 15:00
3 1 1 100%
Loading events...
Credential Probe ea9555b397ea newark_01 · 2026-07-11 15:01
1 20%
Loading events...
Credential Probe e77a982ef9ee newark_01 · 2026-07-11 14:59
1 20%
Loading events...
Credential Probe 412428fffde1 newark_01 · 2026-07-11 14:57
1 20%
Loading events...
Credential Probe 01fb903011e4 newark_01 · 2026-07-11 14:55
1 20%
Loading events...
Opportunistic Bruter 78535d1958c8 newark_01 · 2026-07-11 14:53
1 50%
Loading events...
Malware Dropper 4448528ddea4 newark_01 · 2026-07-11 14:53
3 1 1 100%
Loading events...
Credential Probe 4111eb61cd34 newark_01 · 2026-07-11 14:53
1 20%
Loading events...
Credential Probe 15823f612095 newark_01 · 2026-07-11 14:51
1 20%
Loading events...
Credential Probe 93cc48064555 newark_01 · 2026-07-11 14:49
1 20%
Loading events...
Credential Probe f2d5da32155d newark_01 · 2026-07-11 14:48
1 20%
Loading events...
Opportunistic Bruter a7dbc08a16d9 newark_01 · 2026-07-11 14:46
1 50%
Loading events...
Malware Dropper 526f3a1f7b1f newark_01 · 2026-07-11 14:46
3 1 1 100%
Loading events...
Credential Probe 20389c8fd10a newark_01 · 2026-07-11 14:46
1 20%
Loading events...
Opportunistic Bruter 0584de3f689b newark_01 · 2026-07-11 14:44
1 50%
Loading events...
Malware Dropper 1790992d13e1 newark_01 · 2026-07-11 14:44
3 1 1 100%
Loading events...
Credential Probe 480d245e3a57 newark_01 · 2026-07-11 14:44
1 20%
Loading events...
Malware Dropper c5f41353944d newark_01 · 2026-07-11 14:42
3 1 1 100%
Loading events...
Opportunistic Bruter 62e28baff4d0 newark_01 · 2026-07-11 14:42
1 50%
Loading events...
Credential Probe 7bb2a3e9dc29 newark_01 · 2026-07-11 14:42
1 20%
Loading events...
Credential Probe c875fd056c0e newark_01 · 2026-07-11 14:40
1 20%
Loading events...
Credential Probe fed642fc9e3f newark_01 · 2026-07-11 14:38
1 20%
Loading events...
Opportunistic Bruter e6c37c4475ad newark_01 · 2026-07-11 14:37
1 50%
Loading events...
Malware Dropper a2b11304d717 newark_01 · 2026-07-11 14:37
3 1 1 100%
Loading events...
Credential Probe 7ec29bd3f4c4 newark_01 · 2026-07-11 14:37
1 20%
Loading events...
Credential Probe 7c2fefec9b1e newark_01 · 2026-07-11 14:35
1 20%
Loading events...
Credential Probe caf6735a703f newark_01 · 2026-07-11 14:33
1 20%
Loading events...
Malware Dropper 2bc704580d04 newark_01 · 2026-07-11 14:31
3 1 1 100%
Loading events...
Opportunistic Bruter 785a7e500590 newark_01 · 2026-07-11 14:31
1 50%
Loading events...
Credential Probe 33353e9e00db newark_01 · 2026-07-11 14:31
1 20%
Loading events...