IntrusionLabs IntrusionLabs
← Back to feed

191.191.2.50

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
bfbf0232.virtua.com.br (virtua.com.br) ✗ FCrDNS
Threat Confidence
50%
Assessment
SSH password brute-forcer
  • Logged in with 13 different credentials across 24 logins.
  • Downloaded 12 files and ran 36 commands on the host.
  • Part of a 165-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇧🇷 BR / Florianópolis
ASN
AS28573 · Claro NXT Telecomunicacoes Ltda
Cloud Provider
—
Total Events
321
Top 10% by volume
Agent Count
2
First / Last Seen
2026-09-19 09:48 — 2026-09-21 17:04
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
141 IPs 376589 events
2026-09-22 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
132 IPs 324319 events
2026-09-19 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
141 IPs 362849 events
2026-09-18 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
148 IPs 382890 events
2026-09-14 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
125 IPs 321774 events
2026-09-14 — ongoing · 125 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
109 IPs 88024 events
2026-06-09 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
159 IPs 381203 events
2026-04-15 — ongoing · 159 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
57 IPs 54172 events
2026-04-13 — ongoing · 57 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
33 IPs 20387 events
2026-04-06 — ongoing · 33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
48 IPs 29504 events
2026-03-31 — ongoing · 48 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
118 IPs 313086 events
2026-03-31 — ongoing · 118 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 379539 events
2026-03-31 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
94 IPs 288824 events
2026-03-31 — ongoing · 94 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
135 IPs 350486 events
2026-03-31 — ongoing · 135 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
154 IPs 382507 events
2026-03-31 — ongoing · 154 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 361039 events
2026-03-31 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
85 IPs 121472 events
2026-03-31 — ongoing · 85 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 295155 events
2026-03-31 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
123 IPs 353795 events
2026-03-22 — ongoing · 123 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 401331 events
2026-03-16 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
123 IPs 305622 events
2026-03-14 — ongoing · 123 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
144 IPs 327071 events
2026-03-08 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
114 IPs 346198 events
2026-03-05 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
124 IPs 68687 events
2026-03-05 — ongoing · 124 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
91 IPs 300358 events
2026-03-05 — ongoing · 91 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
111 IPs 332710 events
2026-03-05 — ongoing · 111 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
92 IPs 307354 events
2026-03-05 — ongoing · 92 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
107 IPs 81000 events
2026-03-05 — ongoing · 107 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
75 IPs 223526 events
2026-03-05 — ongoing · 75 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
128 IPs 398457 events
2026-03-05 — ongoing · 128 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 435063 events
2026-03-05 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 415775 events
2026-03-05 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 4446 events
2026-03-03 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×12 credential_probe ×21 opportunistic_bruter ×12
Sessions
45 (24 with login)
Avg Depth Score
0.49
Commands Executed
36
Files Downloaded
12
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Malware Dropper d7ad05a3db45 w4m_seattle_01 · 2026-09-21 17:04
3 1 1 100%
Loading events...
Opportunistic Bruter b08870225a0d w4m_seattle_01 · 2026-09-21 17:04
1 50%
Loading events...
Credential Probe ec6f7cb75d44 w4m_seattle_01 · 2026-09-21 17:04
1 20%
Loading events...
Credential Probe da525a827aa3 w4m_seattle_01 · 2026-09-21 17:02
1 20%
Loading events...
Malware Dropper d3e4d4be09cb w4m_seattle_01 · 2026-09-21 17:00
3 1 1 100%
Loading events...
Opportunistic Bruter 8db6064dfe95 w4m_seattle_01 · 2026-09-21 17:00
1 50%
Loading events...
Credential Probe c658f7abe79f w4m_seattle_01 · 2026-09-21 17:00
1 20%
Loading events...
Opportunistic Bruter 6d10e14f47a8 w4m_seattle_01 · 2026-09-21 16:58
1 50%
Loading events...
Malware Dropper 26479790c839 w4m_seattle_01 · 2026-09-21 16:57
3 1 1 100%
Loading events...
Credential Probe 7025d9141574 w4m_seattle_01 · 2026-09-21 16:58
1 20%
Loading events...
Credential Probe fef2cc73620d w4m_seattle_01 · 2026-09-21 16:55
1 20%
Loading events...
Malware Dropper b0ad38b9fd58 w4m_seattle_01 · 2026-09-21 16:53
3 1 1 100%
Loading events...
Opportunistic Bruter 4c9118a43923 w4m_seattle_01 · 2026-09-21 16:53
1 50%
Loading events...
Credential Probe 77b1707f628d w4m_seattle_01 · 2026-09-21 16:53
1 20%
Loading events...
Malware Dropper 647de031437d w4m_seattle_01 · 2026-09-21 16:51
3 1 1 100%
Loading events...
Opportunistic Bruter 1c1118c5c9a5 w4m_seattle_01 · 2026-09-21 16:51
1 50%
Loading events...
Credential Probe fc41f8c12b79 w4m_seattle_01 · 2026-09-21 16:51
1 20%
Loading events...
Credential Probe 4d364177c13b w4m_seattle_01 · 2026-09-21 16:49
1 20%
Loading events...
Credential Probe 41f482eb5a2a w4m_seattle_01 · 2026-09-21 16:46
1 20%
Loading events...
Opportunistic Bruter 214bebf02886 w4m_seattle_01 · 2026-09-21 16:44
1 50%
Loading events...
Malware Dropper 9a75130e6b7b w4m_seattle_01 · 2026-09-21 16:44
3 1 1 100%
Loading events...
Credential Probe 551ec0b6b44f w4m_seattle_01 · 2026-09-21 16:44
1 20%
Loading events...
Credential Probe 25b70e21a50e w4m_seattle_01 · 2026-09-21 16:42
1 20%
Loading events...
Malware Dropper 1941d69b25c1 w4m_seattle_01 · 2026-09-21 16:40
3 1 1 100%
Loading events...
Opportunistic Bruter d61546ab85fe w4m_seattle_01 · 2026-09-21 16:40
1 50%
Loading events...
Credential Probe db2f2ad7b80b w4m_seattle_01 · 2026-09-21 16:40
1 20%
Loading events...
Credential Probe 9a3abafd4c64 w4m_seattle_01 · 2026-09-21 16:38
1 20%
Loading events...
Malware Dropper 740841ebff77 w4m_seattle_01 · 2026-09-21 16:36
3 1 1 100%
Loading events...
Opportunistic Bruter 911b296818db w4m_seattle_01 · 2026-09-21 16:36
1 50%
Loading events...
Credential Probe 75350c088eea w4m_seattle_01 · 2026-09-21 16:36
1 20%
Loading events...
Opportunistic Bruter 5649545b6fe3 w4m_seattle_01 · 2026-09-21 16:34
1 50%
Loading events...
Malware Dropper 29ab09081171 w4m_seattle_01 · 2026-09-21 16:33
3 1 1 100%
Loading events...
Credential Probe 36c208a077ec w4m_seattle_01 · 2026-09-21 16:33
1 20%
Loading events...
Opportunistic Bruter f0872e904aac w4m_seattle_01 · 2026-09-21 16:31
1 50%
Loading events...
Malware Dropper 5c2d5a53a5c3 w4m_seattle_01 · 2026-09-21 16:31
3 1 1 100%
Loading events...
Credential Probe c2416c47f990 w4m_seattle_01 · 2026-09-21 16:31
1 20%
Loading events...
Malware Dropper a0e9d65aba72 w4m_seattle_01 · 2026-09-21 16:29
3 1 1 100%
Loading events...
Opportunistic Bruter 818ac4cf7293 w4m_seattle_01 · 2026-09-21 16:29
1 50%
Loading events...
Credential Probe 500c82bbe753 w4m_seattle_01 · 2026-09-21 16:29
1 20%
Loading events...
Credential Probe 3ce3b89e4851 w4m_seattle_01 · 2026-09-21 16:27
1 20%
Loading events...
Credential Probe c7406969d559 w4m_seattle_01 · 2026-09-21 16:25
1 20%
Loading events...
Credential Probe 51f8d29f442f w4m_seattle_01 · 2026-09-21 16:17
1 20%
Loading events...
Opportunistic Bruter de418a3d66bb newark_01 · 2026-09-19 09:48
1 50%
Loading events...
Malware Dropper 6065cb0081db newark_01 · 2026-09-19 09:48
3 1 1 100%
Loading events...
Credential Probe 160c696094fc newark_01 · 2026-09-19 09:48
1 20%
Loading events...