IntrusionLabs IntrusionLabs
← Back to feed

161.132.4.157

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
68%
Assessment
SSH password brute-forcer
  • Logged in with 27 different credentials across 52 logins.
  • Downloaded 26 files and ran 78 commands on the host.
  • Active for 19 days, 2026-09-28 to 2026-10-18.
  • Runs the same SSH client fingerprint (HASSH) as 553 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇵🇪 PE
ASN
AS3132 · Red Cientifica Peruana
Cloud Provider
—
Total Events
773
Top 5% by volume
Agent Count
2
First / Last Seen
2026-09-28 13:47 — 2026-10-18 11:17
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-10-19 05:01
blocklist_de:reported
Campaigns
Multi-Agent Scan SCAN Active medium
183 IPs 557735 events
2026-09-28 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 542515 events
2026-09-28 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 589872 events
2026-09-26 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
138 IPs 470318 events
2026-09-24 — ongoing · 138 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
162 IPs 206695 events
2026-09-24 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
263 IPs 682982 events
2026-09-17 — ongoing · 263 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS3132 Red Cientifica Peruana ASN Active medium 🇵🇪 PE
5 IPs 6466 events
ssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:intrusion
2026-06-23 — ongoing · 5 IPs from the same network (Red Cientifica Peruana, AS3132) were active during overlapping time periods. Temporal correlation …
Multi-Agent Scan SCAN Active medium
232 IPs 659179 events
2026-04-23 — ongoing · 232 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 142158 events
2026-04-16 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
207 IPs 518210 events
2026-04-16 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
167 IPs 181042 events
2026-04-15 — ongoing · 167 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
47 IPs 95859 events
2026-04-06 — ongoing · 47 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 591419 events
2026-03-26 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 653684 events
2026-03-26 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 576953 events
2026-03-26 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 627511 events
2026-03-26 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
155 IPs 204484 events
2026-03-26 — ongoing · 155 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
82 IPs 142750 events
2026-03-26 — ongoing · 82 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 718043 events
2026-03-26 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 710316 events
2026-03-26 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
244 IPs 332239 events
2026-03-26 — ongoing · 244 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 563656 events
2026-03-26 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
232 IPs 594106 events
2026-03-19 — ongoing · 232 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
118 IPs 120649 events
2026-03-15 — ongoing · 118 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 576227 events
2026-03-13 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
155 IPs 199319 events
2026-03-12 — ongoing · 155 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
267 IPs 711453 events
2026-03-09 — ongoing · 267 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
131 IPs 548224 events
2026-03-01 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
229 IPs 702873 events
2026-03-01 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
207 IPs 683205 events
2026-02-26 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
150 IPs 385049 events
2026-02-26 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
213 IPs 436112 events
2026-02-26 — ongoing · 213 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (554 IPs, 70 countries) HASSH Active high 🇺🇸 US
554 IPs 825577 events
smtp:relayssh:bruteforcessh:connectionssh:intrusionssh:malwaressh:proxy-abuse
2026-02-25 — ongoing · 554 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Microsoft Corporation (AS8075). Geographic and …
Session Forensics
malware_dropper ×26 credential_probe ×61 opportunistic_bruter ×26
Sessions
113 (52 with login)
Avg Depth Score
0.45
Commands Executed
78
Files Downloaded
26
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe 9bae9fc1a0f0 w4m_seattle_01 · 2026-10-18 11:17
1 20%
Loading events...
Credential Probe 1ed034cd0c76 w4m_seattle_01 · 2026-10-18 11:16
1 20%
Loading events...
Credential Probe 48812f4b75dd w4m_seattle_01 · 2026-10-18 11:14
1 20%
Loading events...
Credential Probe d2b8dcddc69e w4m_seattle_01 · 2026-10-18 11:13
1 20%
Loading events...
Credential Probe c117e470edad w4m_seattle_01 · 2026-10-18 11:12
1 20%
Loading events...
Opportunistic Bruter 826a93cf8512 w4m_seattle_01 · 2026-10-18 11:10
1 50%
Loading events...
Malware Dropper 0be8a0ebeffa w4m_seattle_01 · 2026-10-18 11:10
3 1 1 100%
Loading events...
Credential Probe f48c4c5b348d w4m_seattle_01 · 2026-10-18 11:10
1 20%
Loading events...
Malware Dropper 052d12d739b3 w4m_seattle_01 · 2026-10-18 11:09
3 1 1 100%
Loading events...
Opportunistic Bruter 9b1de500c58e w4m_seattle_01 · 2026-10-18 11:09
1 50%
Loading events...
Credential Probe c5335c437e28 w4m_seattle_01 · 2026-10-18 11:09
1 20%
Loading events...
Opportunistic Bruter 75ebeb5df662 w4m_seattle_01 · 2026-10-18 11:07
1 50%
Loading events...
Malware Dropper 604ea404b3a0 w4m_seattle_01 · 2026-10-18 11:07
3 1 1 100%
Loading events...
Credential Probe 1e2082da06d1 w4m_seattle_01 · 2026-10-18 11:07
1 20%
Loading events...
Credential Probe 43311c3a0b39 w4m_seattle_01 · 2026-10-18 11:06
1 20%
Loading events...
Credential Probe c651ccc9f9a9 w4m_seattle_01 · 2026-10-18 11:04
1 20%
Loading events...
Malware Dropper c1d350df6c21 w4m_seattle_01 · 2026-10-18 11:03
3 1 1 100%
Loading events...
Opportunistic Bruter bf4e11297cf0 w4m_seattle_01 · 2026-10-18 11:03
1 50%
Loading events...
Credential Probe 1f5f6d476383 w4m_seattle_01 · 2026-10-18 11:03
1 20%
Loading events...
Credential Probe 18bc88301894 w4m_seattle_01 · 2026-10-18 11:02
1 20%
Loading events...
Opportunistic Bruter 0e53a592e293 w4m_seattle_01 · 2026-10-18 11:00
1 50%
Loading events...
Malware Dropper c6b192295ced w4m_seattle_01 · 2026-10-18 11:00
3 1 1 100%
Loading events...
Credential Probe 3372248a55c1 w4m_seattle_01 · 2026-10-18 11:00
1 20%
Loading events...
Credential Probe 0af6fdb06c76 w4m_seattle_01 · 2026-10-18 10:59
1 20%
Loading events...
Credential Probe 5a56b3d8557c w4m_seattle_01 · 2026-10-18 10:57
1 20%
Loading events...
Opportunistic Bruter 9bd37dad35ed w4m_seattle_01 · 2026-10-18 10:56
1 50%
Loading events...
Malware Dropper 5c49bba29881 w4m_seattle_01 · 2026-10-18 10:56
3 1 1 100%
Loading events...
Credential Probe 4baf37c26b7c w4m_seattle_01 · 2026-10-18 10:56
1 20%
Loading events...
Opportunistic Bruter e4920aa88d1f w4m_seattle_01 · 2026-10-18 10:55
1 50%
Loading events...
Malware Dropper cb3262e7a3b2 w4m_seattle_01 · 2026-10-18 10:55
3 1 1 100%
Loading events...
Credential Probe 71df266986e5 w4m_seattle_01 · 2026-10-18 10:55
1 20%
Loading events...
Malware Dropper 4b072d8fad22 w4m_seattle_01 · 2026-10-18 10:53
3 1 1 100%
Loading events...
Opportunistic Bruter d7781a74b3bc w4m_seattle_01 · 2026-10-18 10:53
1 50%
Loading events...
Credential Probe 2c39a9de68fd w4m_seattle_01 · 2026-10-18 10:53
1 20%
Loading events...
Opportunistic Bruter 723e1a3bc35e w4m_seattle_01 · 2026-10-18 10:52
1 50%
Loading events...
Malware Dropper 701f50b29d58 w4m_seattle_01 · 2026-10-18 10:52
3 1 1 100%
Loading events...
Credential Probe 7435912c8b91 w4m_seattle_01 · 2026-10-18 10:52
1 20%
Loading events...
Credential Probe 0faa9f05357c w4m_seattle_01 · 2026-10-18 10:46
1 20%
Loading events...
Malware Dropper 251394a93d05 w4m_seattle_01 · 2026-10-13 14:52
3 1 1 100%
Loading events...
Opportunistic Bruter 0ce5c4cd1600 w4m_seattle_01 · 2026-10-13 14:52
1 50%
Loading events...
Credential Probe ba41917bdf9e w4m_seattle_01 · 2026-10-13 14:52
1 20%
Loading events...
Opportunistic Bruter 0881b66d200e w4m_seattle_01 · 2026-10-13 14:50
1 50%
Loading events...
Malware Dropper 70cffc647413 w4m_seattle_01 · 2026-10-13 14:50
3 1 1 100%
Loading events...
Credential Probe 6b67bb4570ad w4m_seattle_01 · 2026-10-13 14:50
1 20%
Loading events...
Opportunistic Bruter 422207a9bcf9 w4m_seattle_01 · 2026-10-13 14:49
1 50%
Loading events...
Malware Dropper 1dcad8d9c6ec w4m_seattle_01 · 2026-10-13 14:49
3 1 1 100%
Loading events...
Credential Probe 2846652154c7 w4m_seattle_01 · 2026-10-13 14:49
1 20%
Loading events...
Credential Probe d0cec9aaf401 w4m_seattle_01 · 2026-10-13 14:47
1 20%
Loading events...
Malware Dropper a0adbd4fe048 w4m_seattle_01 · 2026-10-13 14:46
3 1 1 100%
Loading events...
Opportunistic Bruter 57d7e3586763 w4m_seattle_01 · 2026-10-13 14:46
1 50%
Loading events...