IntrusionLabs / threat intelligence

← Back to feed

172.212.171.149

Threat Confidence

31%

Location

🇺🇸 US / Des Moines

ASN

AS8075 · Microsoft Corporation

Cloud Provider

Microsoft Azure

Total Events

240

Top 10% by volume

Agent Count

1

First / Last Seen

2026-02-24 15:27 — 2026-02-24 20:08

Attack Types

ssh:bruteforce

External Corroboration

Not flagged by any external feeds

Campaigns

Not associated with any campaigns

Session Forensics

reconnaissance ×29 credential_harvester ×1

Sessions

30 (29 with login)

Avg Depth Score

0.59

Commands Executed

32

Files Downloaded

0

Notable Commands

whoami
hostname
ls -la /
uptime
ps aux | head -10
env | head -10
uname -a
nproc 2>/dev/null || (grep -c '^processor' /proc/cpuinfo 2>/dev/null) || echo 0
grep -c ^processor /proc/cpuinfo 2 > /dev/null
pwd
grep 'model name' /proc/cpuinfo 2>/dev/null | head -1 | cut -d ':' -f2- | sed 's/^ *//' | xargs || echo unknown
xargs
mount | head -5
history | tail -5

Fingerprints

HASSH

16443846184eafde36765c9bab2f4397

SSH Client

SSH-2.0-Go

Recent Events (last 50)

Timestamp	Port	Proto	Event	Location
2026-02-24 20:08:53	:22	ssh	cowrie.session.closed	sin
2026-02-24 20:08:53	:22	ssh	cowrie.log.closed	sin
2026-02-24 20:08:53	:22	ssh	cowrie.command.input	sin
2026-02-24 20:08:53	:22	ssh	cowrie.session.params	sin
2026-02-24 20:08:53	:22	ssh	cowrie.login.success	sin
2026-02-24 20:08:52	:22	ssh	cowrie.client.kex	sin
2026-02-24 20:08:52	:22	ssh	cowrie.client.version	sin
2026-02-24 20:08:52	:22	ssh	cowrie.session.connect	sin
2026-02-24 19:58:31	:22	ssh	cowrie.session.closed	sin
2026-02-24 19:58:31	:22	ssh	cowrie.log.closed	sin
2026-02-24 19:58:31	:22	ssh	cowrie.command.input	sin
2026-02-24 19:58:31	:22	ssh	cowrie.session.params	sin
2026-02-24 19:58:30	:22	ssh	cowrie.login.success	sin
2026-02-24 19:58:30	:22	ssh	cowrie.client.kex	sin
2026-02-24 19:58:30	:22	ssh	cowrie.client.version	sin
2026-02-24 19:58:30	:22	ssh	cowrie.session.connect	sin
2026-02-24 19:48:25	:22	ssh	cowrie.session.closed	sin
2026-02-24 19:48:25	:22	ssh	cowrie.log.closed	sin
2026-02-24 19:48:25	:22	ssh	cowrie.command.input	sin
2026-02-24 19:48:25	:22	ssh	cowrie.session.params	sin
2026-02-24 19:48:24	:22	ssh	cowrie.login.success	sin
2026-02-24 19:48:24	:22	ssh	cowrie.client.kex	sin
2026-02-24 19:48:23	:22	ssh	cowrie.client.version	sin
2026-02-24 19:48:23	:22	ssh	cowrie.session.connect	sin
2026-02-24 19:38:24	:22	ssh	cowrie.session.closed	sin
2026-02-24 19:38:24	:22	ssh	cowrie.log.closed	sin
2026-02-24 19:38:24	:22	ssh	cowrie.command.input	sin
2026-02-24 19:38:24	:22	ssh	cowrie.session.params	sin
2026-02-24 19:38:24	:22	ssh	cowrie.login.success	sin
2026-02-24 19:38:23	:22	ssh	cowrie.client.kex	sin
2026-02-24 19:38:23	:22	ssh	cowrie.client.version	sin
2026-02-24 19:38:23	:22	ssh	cowrie.session.connect	sin
2026-02-24 19:28:21	:22	ssh	cowrie.session.closed	sin
2026-02-24 19:28:21	:22	ssh	cowrie.log.closed	sin
2026-02-24 19:28:21	:22	ssh	cowrie.command.input	sin
2026-02-24 19:28:21	:22	ssh	cowrie.session.params	sin
2026-02-24 19:28:20	:22	ssh	cowrie.login.success	sin
2026-02-24 19:28:20	:22	ssh	cowrie.client.kex	sin
2026-02-24 19:28:20	:22	ssh	cowrie.client.version	sin
2026-02-24 19:28:20	:22	ssh	cowrie.session.connect	sin
2026-02-24 19:18:20	:22	ssh	cowrie.session.closed	sin
2026-02-24 19:18:20	:22	ssh	cowrie.log.closed	sin
2026-02-24 19:18:19	:22	ssh	cowrie.command.input	sin
2026-02-24 19:18:19	:22	ssh	cowrie.session.params	sin
2026-02-24 19:18:19	:22	ssh	cowrie.login.success	sin
2026-02-24 19:18:18	:22	ssh	cowrie.client.kex	sin
2026-02-24 19:18:18	:22	ssh	cowrie.client.version	sin
2026-02-24 19:18:18	:22	ssh	cowrie.session.connect	sin
2026-02-24 19:08:23	:22	ssh	cowrie.session.closed	sin
2026-02-24 19:08:23	:22	ssh	cowrie.log.closed	sin