← Back to feed

192.42.116.99

TAGGED SUSPICIOUS how we decide →
Threat Confidence
59%
Location
🇳🇱 NL
ASN
AS215125 · Church of Cyberology
Cloud Provider
Total Events
22
Average by volume
Agent Count
2
First / Last Seen
2026-04-28 20:07 — 2026-05-01 22:25
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
Initial Access
Credential Access
Discovery
Command and Control
External Corroboration
Tor Exit Nodes
Reported 2026-05-01 10:28
tor:exit_node
Campaigns
Subnet 192.42.116.0/24 SUBNET Active high 🇳🇱 NL
13 IPs 164 events
http:scanssh:bruteforce
2026-04-11 — ongoing · 13 IPs from the same /24 subnet (192.42.116.0/24) were observed attacking our sensors within the same time window. …
Multi-Agent Scan SCAN Active medium
78 IPs 170916 events
2026-03-09 — ongoing · 78 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
82 IPs 150464 events
2026-03-09 — ongoing · 82 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
124 IPs 172763 events
2026-03-09 — ongoing · 124 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
78 IPs 150177 events
2026-03-09 — ongoing · 78 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
81 IPs 150443 events
2026-03-09 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
60 IPs 41608 events
2026-03-09 — ongoing · 60 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
30 IPs 20041 events
2026-03-09 — ongoing · 30 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 176078 events
2026-03-09 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
79 IPs 159330 events
2026-03-09 — ongoing · 79 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
114 IPs 180729 events
2026-03-09 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
79 IPs 150356 events
2026-03-07 — ongoing · 79 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
98 IPs 61580 events
2026-03-04 — ongoing · 98 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 proxy_abuser ×1 reconnaissance ×1
Sessions
3 (2 with login)
Avg Depth Score
0.53
Commands Executed
3
Files Downloaded
0
Notable Commands
  • echo "cat /proc/1/mounts && ls /proc/1/; curl2" | sh
  • cat /proc/1/mounts && ls /proc/1/; curl2
  • curl2
Fingerprints
SSH-2.0-GoSSH-2.0-OpenSSH_9.9
t12d3112h2_e8f1e7e78f70_64f78f54e6a2
Evidence Timeline
Reconnaissance 4c6e1c1c6b6a w4m_singapore_01 · 2026-05-01 22:25
3 1 60%
Loading events...
Scanner e2bdae08008e w4m_seattle_01 · 2026-05-01 20:01
15%
Loading events...
Proxy Abuser 875c74f28d05 w4m_singapore_01 · 2026-04-28 20:07
2 85%
Loading events...