IntrusionLabs IntrusionLabs
← Back to feed

172.213.17.173

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
56%
Assessment
SSH password brute-forcer
  • Logged in with 22 different credentials across 42 logins.
  • Downloaded 21 files and ran 63 commands on the host.
  • Part of a 258-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇮🇹 IT / Milan
ASN
AS8075 · Microsoft Corporation
Cloud Provider
Microsoft Azure
Total Events
678
Top 10% by volume
Agent Count
2
First / Last Seen
2026-10-04 16:07 — 2026-10-11 13:31
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-10-19 05:01
blocklist_de:reported
Campaigns
Multi-Agent Scan SCAN Active medium
152 IPs 512358 events
2026-09-30 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 943176 events
2026-09-26 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 754100 events
2026-09-25 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 733286 events
2026-09-24 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 530875 events
2026-09-21 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
97 IPs 88019 events
2026-09-21 — ongoing · 97 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
210 IPs 804750 events
2026-09-14 — ongoing · 210 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 936655 events
2026-09-14 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
255 IPs 913894 events
2026-09-09 — ongoing · 255 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
176 IPs 259222 events
2026-08-12 — ongoing · 176 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
51 IPs 185054 events
2026-06-24 — ongoing · 51 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 433373 events
2026-05-29 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
249 IPs 949314 events
2026-05-29 — ongoing · 249 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
229 IPs 821543 events
2026-05-29 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
258 IPs 916376 events
2026-05-29 — ongoing · 258 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 1006448 events
2026-05-29 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
168 IPs 659424 events
2026-05-22 — ongoing · 168 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 769003 events
2026-05-22 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 695575 events
2026-05-22 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
84 IPs 418121 events
2026-05-22 — ongoing · 84 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 687590 events
2026-05-22 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 617389 events
2026-05-22 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
207 IPs 747812 events
2026-05-22 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 700766 events
2026-05-19 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
16 IPs 92746 events
2026-04-30 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
40 IPs 98127 events
2026-04-20 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
198 IPs 770176 events
2026-04-05 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 978711 events
2026-03-08 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
242 IPs 955105 events
2026-03-03 — ongoing · 242 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 648130 events
2026-03-03 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 889399 events
2026-03-03 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 928166 events
2026-03-01 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
231 IPs 649948 events
2026-02-28 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
215 IPs 723467 events
2026-02-26 — ongoing · 215 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×21 credential_probe ×60 opportunistic_bruter ×21
Sessions
102 (42 with login)
Avg Depth Score
0.43
Commands Executed
63
Files Downloaded
21
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe e9e32d9a3ad4 w4m_singapore_01 · 2026-10-11 13:31
1 20%
Loading events...
Malware Dropper f9964e92608c w4m_singapore_01 · 2026-10-11 13:29
3 1 1 100%
Loading events...
Opportunistic Bruter 4e13b8dc7a0a w4m_singapore_01 · 2026-10-11 13:29
1 50%
Loading events...
Credential Probe 09882236176b w4m_singapore_01 · 2026-10-11 13:29
1 20%
Loading events...
Credential Probe fd7020800437 w4m_singapore_01 · 2026-10-11 13:27
1 20%
Loading events...
Credential Probe f0817a5805f7 w4m_singapore_01 · 2026-10-11 13:26
1 20%
Loading events...
Credential Probe 8a4fbb5955c5 w4m_singapore_01 · 2026-10-11 13:24
1 20%
Loading events...
Credential Probe 42481fe19e6a w4m_singapore_01 · 2026-10-11 13:23
1 20%
Loading events...
Credential Probe f847210df339 w4m_singapore_01 · 2026-10-11 13:21
1 20%
Loading events...
Credential Probe 77f28f37b647 w4m_singapore_01 · 2026-10-11 13:20
1 20%
Loading events...
Opportunistic Bruter 807966b52c75 w4m_singapore_01 · 2026-10-11 13:18
1 50%
Loading events...
Malware Dropper e1dd04abd97a w4m_singapore_01 · 2026-10-11 13:18
3 1 1 100%
Loading events...
Credential Probe fea49e2e72d8 w4m_singapore_01 · 2026-10-11 13:18
1 20%
Loading events...
Opportunistic Bruter bbf727b93fc5 w4m_singapore_01 · 2026-10-11 13:17
1 50%
Loading events...
Malware Dropper fcde282a2005 w4m_singapore_01 · 2026-10-11 13:17
3 1 1 100%
Loading events...
Credential Probe 9e7ce6318305 w4m_singapore_01 · 2026-10-11 13:17
1 20%
Loading events...
Credential Probe 0172ee272779 w4m_singapore_01 · 2026-10-11 13:15
1 20%
Loading events...
Opportunistic Bruter 5a0d344860b9 w4m_singapore_01 · 2026-10-11 13:14
1 50%
Loading events...
Malware Dropper 73d2d9fe2c1e w4m_singapore_01 · 2026-10-11 13:14
3 1 1 100%
Loading events...
Credential Probe 42c342d7f013 w4m_singapore_01 · 2026-10-11 13:14
1 20%
Loading events...
Opportunistic Bruter c1a0b6268214 w4m_singapore_01 · 2026-10-11 13:12
1 50%
Loading events...
Malware Dropper eadf6c578fcf w4m_singapore_01 · 2026-10-11 13:12
3 1 1 100%
Loading events...
Credential Probe 2f17031bc9d8 w4m_singapore_01 · 2026-10-11 13:12
1 20%
Loading events...
Opportunistic Bruter f329ac8f4e99 w4m_singapore_01 · 2026-10-11 13:10
1 50%
Loading events...
Malware Dropper 08d29736b2b3 w4m_singapore_01 · 2026-10-11 13:10
3 1 1 100%
Loading events...
Credential Probe 2cc9a46e4a1b w4m_singapore_01 · 2026-10-11 13:10
1 20%
Loading events...
Credential Probe 0ab2a00a251d w4m_singapore_01 · 2026-10-11 13:09
1 20%
Loading events...
Credential Probe 31f0b801802f w4m_singapore_01 · 2026-10-11 13:07
1 20%
Loading events...
Opportunistic Bruter 791d46f2e996 w4m_singapore_01 · 2026-10-11 13:06
1 50%
Loading events...
Malware Dropper d50df49484f5 w4m_singapore_01 · 2026-10-11 13:06
3 1 1 100%
Loading events...
Credential Probe 45916cc41ab2 w4m_singapore_01 · 2026-10-11 13:06
1 20%
Loading events...
Opportunistic Bruter 402bd7ab8c9b w4m_singapore_01 · 2026-10-11 13:04
1 50%
Loading events...
Malware Dropper 4715798a3d6a w4m_singapore_01 · 2026-10-11 13:04
3 1 1 100%
Loading events...
Credential Probe fb7591618f89 w4m_singapore_01 · 2026-10-11 13:04
1 20%
Loading events...
Credential Probe 7de79542ac4d w4m_singapore_01 · 2026-10-11 13:03
1 20%
Loading events...
Credential Probe bd2e75b09f3a w4m_singapore_01 · 2026-10-11 13:00
1 20%
Loading events...
Credential Probe 7b7234659698 newark_01 · 2026-10-11 03:02
1 20%
Loading events...
Credential Probe 46adcc24c878 newark_01 · 2026-10-11 03:00
1 20%
Loading events...
Malware Dropper 28ff199ebdf3 newark_01 · 2026-10-11 02:59
3 1 1 100%
Loading events...
Opportunistic Bruter e2383df0c887 newark_01 · 2026-10-11 02:59
1 50%
Loading events...
Credential Probe da63ef52f930 newark_01 · 2026-10-11 02:59
1 20%
Loading events...
Credential Probe cdadd12edf07 newark_01 · 2026-10-11 02:57
1 20%
Loading events...
Opportunistic Bruter b86ee165743d newark_01 · 2026-10-11 02:56
1 50%
Loading events...
Malware Dropper b3aa62f32940 newark_01 · 2026-10-11 02:56
3 1 1 100%
Loading events...
Credential Probe 97604d3ec7b7 newark_01 · 2026-10-11 02:56
1 20%
Loading events...
Credential Probe a4ffe57637fc newark_01 · 2026-10-11 02:54
1 20%
Loading events...
Credential Probe 98accbb43cee newark_01 · 2026-10-11 02:52
1 20%
Loading events...
Credential Probe 92ae1e8addcf newark_01 · 2026-10-11 02:51
1 20%
Loading events...
Opportunistic Bruter 20baa9018c59 newark_01 · 2026-10-11 02:49
1 50%
Loading events...
Malware Dropper 81f34bf86131 newark_01 · 2026-10-11 02:49
3 1 1 100%
Loading events...