IntrusionLabs / threat intelligence

Sign in

← Back to feed

159.65.222.96

TAGGED SUSPICIOUS how we decide →

Threat Confidence

50%

Location

🇺🇸 US / North Bergen

ASN

AS14061 · DigitalOcean, LLC

Cloud Provider

DigitalOcean

Total Events

317

Above average by volume

Agent Count

2

First / Last Seen

2026-06-17 00:08 — 2026-06-25 07:16

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Command and Control

T1105

External Corroboration

Not flagged by any external feeds

Campaigns

Not associated with any campaigns

Session Forensics

malware_dropper ×9 credential_probe ×31 opportunistic_bruter ×9

Sessions

49 (18 with login)

Avg Depth Score

0.4

Commands Executed

27

Files Downloaded

9

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

f555226df1963d1d3c09daf865abdc9a

SSH Client

SSH-2.0-libssh_0.9.6

Evidence Timeline

Credential Probe 8b9519ef377c w4m_singapore_01 · 2026-06-25 07:16

1 20%

Loading events...

Credential Probe 51b45d3ce618 w4m_singapore_01 · 2026-06-25 07:14

1 20%

Loading events...

Credential Probe 977dc764f469 w4m_singapore_01 · 2026-06-25 07:12

1 20%

Loading events...

Opportunistic Bruter e087e763bc6c w4m_singapore_01 · 2026-06-25 07:10

1 50%

Loading events...

Malware Dropper d7cb82489712 w4m_singapore_01 · 2026-06-25 07:10

3 1 1 100%

Loading events...

Credential Probe cb2c6470d57e w4m_singapore_01 · 2026-06-25 07:10

1 20%

Loading events...

Credential Probe 330c767d18e8 w4m_singapore_01 · 2026-06-25 07:08

1 20%

Loading events...

Credential Probe c76dfabdf57c w4m_singapore_01 · 2026-06-25 07:06

1 20%

Loading events...

Credential Probe 176ab1c096d6 w4m_singapore_01 · 2026-06-25 07:04

1 20%

Loading events...

Credential Probe 5d3e76daa40f w4m_singapore_01 · 2026-06-25 07:02

1 20%

Loading events...

Opportunistic Bruter 8fa3d705fdf1 w4m_singapore_01 · 2026-06-25 07:01

1 50%

Loading events...

Malware Dropper 9eb9b0aca43e w4m_singapore_01 · 2026-06-25 07:00

3 1 1 100%

Loading events...

Credential Probe a5498fa8ff14 w4m_singapore_01 · 2026-06-25 07:01

1 20%

Loading events...

Opportunistic Bruter 9763add2a1dc w4m_singapore_01 · 2026-06-25 06:59

1 50%

Loading events...

Malware Dropper ea8a2375607c w4m_singapore_01 · 2026-06-25 06:59

3 1 1 100%

Loading events...

Credential Probe cb21eb79afbe w4m_singapore_01 · 2026-06-25 06:59

1 20%

Loading events...

Credential Probe dd72d43990aa w4m_singapore_01 · 2026-06-25 06:57

1 20%

Loading events...

Credential Probe 9654cdebcd54 w4m_singapore_01 · 2026-06-25 06:55

1 20%

Loading events...

Credential Probe 5c9455f50d8c w4m_singapore_01 · 2026-06-25 06:53

1 20%

Loading events...

Credential Probe c59005e96f93 w4m_singapore_01 · 2026-06-25 06:51

1 20%

Loading events...

Credential Probe ec44bfcba7ea w4m_singapore_01 · 2026-06-25 06:49

1 20%

Loading events...

Credential Probe 5baa3cfe86fa w4m_singapore_01 · 2026-06-25 06:47

1 20%

Loading events...

Credential Probe 9195b5d2fb8d w4m_singapore_01 · 2026-06-25 06:45

1 20%

Loading events...

Malware Dropper a1bc7dda78da w4m_singapore_01 · 2026-06-25 06:43

3 1 1 100%

Loading events...

Opportunistic Bruter b662dcb7df7b w4m_singapore_01 · 2026-06-25 06:43

1 50%

Loading events...

Credential Probe b4d0572ee6ad w4m_singapore_01 · 2026-06-25 06:43

1 20%

Loading events...

Credential Probe 951254bc55d5 w4m_singapore_01 · 2026-06-25 06:41

1 20%

Loading events...

Opportunistic Bruter cd3a348c9bf8 w4m_singapore_01 · 2026-06-25 06:39

1 50%

Loading events...

Malware Dropper 168a090e198c w4m_singapore_01 · 2026-06-25 06:39

3 1 1 100%

Loading events...

Credential Probe ea67415093ff w4m_singapore_01 · 2026-06-25 06:39

1 20%

Loading events...

Credential Probe 3976b963ef04 w4m_singapore_01 · 2026-06-25 06:37

1 20%

Loading events...

Credential Probe 8ff1b3eded87 w4m_singapore_01 · 2026-06-25 06:35

1 20%

Loading events...

Credential Probe 779221bbdf5e w4m_singapore_01 · 2026-06-25 06:34

1 20%

Loading events...

Credential Probe 7f9e07ccc155 w4m_singapore_01 · 2026-06-25 06:32

1 20%

Loading events...

Credential Probe 9a8d1d91794c w4m_singapore_01 · 2026-06-25 06:30

1 20%

Loading events...

Malware Dropper d437e125edf4 w4m_singapore_01 · 2026-06-25 06:28

3 1 1 100%

Loading events...

Opportunistic Bruter 79511c2455ea w4m_singapore_01 · 2026-06-25 06:28

1 50%

Loading events...

Credential Probe 76811839c285 w4m_singapore_01 · 2026-06-25 06:28

1 20%

Loading events...

Opportunistic Bruter 2af8cd94b399 w4m_singapore_01 · 2026-06-25 06:26

1 50%

Loading events...

Malware Dropper 2f7e13e1cce2 w4m_singapore_01 · 2026-06-25 06:26

3 1 1 100%

Loading events...

Credential Probe 36a2c4ba8694 w4m_singapore_01 · 2026-06-25 06:26

1 20%

Loading events...

Credential Probe 82439476a7ab w4m_singapore_01 · 2026-06-25 06:24

1 20%

Loading events...

Opportunistic Bruter ec1c35e53da5 w4m_singapore_01 · 2026-06-25 06:22

1 50%

Loading events...

Malware Dropper b2f4bbdbe250 w4m_singapore_01 · 2026-06-25 06:22

3 1 1 100%

Loading events...

Credential Probe fb44e43af0ad w4m_singapore_01 · 2026-06-25 06:22

1 20%

Loading events...

Credential Probe ae4b9ac29113 w4m_singapore_01 · 2026-06-25 06:19

1 20%

Loading events...

Opportunistic Bruter b69484dbead9 newark_01 · 2026-06-17 00:08

1 50%

Loading events...

Malware Dropper 963d0a7aab5f newark_01 · 2026-06-17 00:08

3 1 1 100%

Loading events...

Credential Probe 199538f52a38 newark_01 · 2026-06-17 00:08

1 20%

Loading events...