IntrusionLabs IntrusionLabs
← Back to feed

196.200.96.18

Threat Confidence
28%
Location
🇪🇷 ER / Asmara
ASN
AS30987 · Eritrea Telecommunication Service corporation (EriTel)
Cloud Provider
—
Total Events
53
Above average by volume
Agent Count
1
First / Last Seen
2026-08-23 17:54 — 2026-08-24 06:53
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
reconnaissance ×1 credential_probe ×6 opportunistic_bruter ×3
Sessions
10 (4 with login)
Avg Depth Score
0.33
Commands Executed
1
Files Downloaded
0
Notable Commands
  • uname -a 2>/dev/null || echo 'Unknown'
Fingerprints
HASSH
1e7f24b2464c2c8dd2a3382c3573847532059948b4a208469697b0f3b7d37f394cdb693eab01614ca9b09293bd1e8da37ead36ddb9152937fa0f2d7cd5bd25648a908b33bf56fb9543fc9717a62b5650bec96763e6755d34ae044d78ab626692c43649afda12679f66390b4d3e5d643ecbb7cb58f9f3eedcd8648382f487299aced4c3f4d09da52f6207a9fb12320547f4bd81ba5e8d2e98f480bb1db70ebfef
SSH Client
SSH-2.0-Go
Evidence Timeline
Credential Probe dac6472942d2 newark_01 · 2026-08-24 06:53
1 20%
Loading events...
Credential Probe 04d802f7dfb5 newark_01 · 2026-08-24 06:41
1 20%
Loading events...
Credential Probe 351009971ef1 newark_01 · 2026-08-24 03:32
1 20%
Loading events...
Credential Probe af7e8d632ff9 newark_01 · 2026-08-24 03:20
1 20%
Loading events...
Opportunistic Bruter 587f366a3859 newark_01 · 2026-08-24 00:17
1 50%
Loading events...
Opportunistic Bruter 91e766e826b4 newark_01 · 2026-08-24 00:06
1 50%
Loading events...
Credential Probe b75ef8b7a96a newark_01 · 2026-08-23 21:04
1 20%
Loading events...
Credential Probe 2ec35f060065 newark_01 · 2026-08-23 20:53
1 20%
Loading events...
Opportunistic Bruter 2e1ee71836f3 newark_01 · 2026-08-23 19:04
1 50%
Loading events...
Reconnaissance dee9160d2bc7 newark_01 · 2026-08-23 17:54
1 1 60%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}