IntrusionLabs IntrusionLabs
← Back to feed

193.24.123.123

TAGGED SUSPICIOUS how we decide →
Threat Confidence
27%
Location
🇷🇺 RU
ASN
AS200593 · Prospero Ooo
Cloud Provider
—
Total Events
27
Average by volume
Agent Count
1
First / Last Seen
2026-09-07 01:25 — 2026-09-07 01:48
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1082 T1083
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
reconnaissance ×2 opportunistic_bruter ×1
Sessions
3 (3 with login)
Avg Depth Score
0.57
Commands Executed
8
Files Downloaded
0
Notable Commands
  • id 2>/dev/null; hostname 2>/dev/null; uname -r 2>/dev/null; echo __NET__; ip -4 addr show 2>/dev/null | grep inet | grep -v 127.0.0.1; ip route 2>/dev/null | head -6; echo __WWW__; ls /var/www /var/www/html /srv/www /home 2>/dev/null | head -20; ls /var/www/*/app/Mage.php /var/www/*/*/app/Mage.php /var/www/html/app/Mage.php /var/www/*/wp-config.php /var/www/html/wp-config.php /var/www/*/*/wp-config.php /var/www/html/wp-load.php /var/www/*/config.php /var/www/html/config.php /var/www/*/settings.php /var/www/html/admin/config.php 2>/dev/null | head -12; echo __ENV__; find /var/www /home /srv /opt -maxdepth 3 -name .env -o -maxdepth 3 -name .env.local 2>/dev/null | head -8; echo __WALLET__; ls -d /root/.bitcoin /root/.litecoin /root/.electrum* /root/.ethereum /root/.monero /root/.dogecoin /home/*/.bitcoin /home/*/.electrum* /home/*/.ethereum /home/*/.monero /home/*/.dogecoin /root/MultiBit* 2>/dev/null; echo __DOCKER__; docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | head -10; echo __LISTEN__; (ss -tlnp 2>/dev/null || netstat -tlnp 2>/dev/null) | head -18; echo __DONE__
  • ss -tlnp 2 > /dev/null
  • netstat -tlnp 2 > /dev/null
  • docker ps --format {{.Names}} {{.Image}}
Fingerprints
HASSH
a2de0f306611e0957be704f5b0e35a82
SSH Client
SSH-2.0-paramiko_3.5.1
Evidence Timeline
Reconnaissance 4d9314c537c3 newark_01 · 2026-09-07 01:43
4 1 60%
Loading events...
Reconnaissance 21a0533b3963 newark_01 · 2026-09-07 01:30
4 1 60%
Loading events...
Opportunistic Bruter b77b0550e691 newark_01 · 2026-09-07 01:25
1 50%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}