IntrusionLabs IntrusionLabs
← Back to feed

197.248.207.142

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
197-248-207-142.safaricombusiness.co.ke (safaricombusiness.co.ke) ✗ FCrDNS
Threat Confidence
55%
Assessment
SSH password brute-forcer
  • Logged in with 15 different credentials across 28 logins.
  • Downloaded 14 files and ran 42 commands on the host.
  • Part of a 258-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇪 KE / Nairobi
ASN
AS37061 · Safaricom Limited
Cloud Provider
—
Total Events
447
Top 10% by volume
Agent Count
2
First / Last Seen
2026-10-09 16:34 — 2026-10-11 07:04
Attack Types
ssh:bruteforce ssh:connection ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1046
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-10-19 05:01
blocklist_de:reported
Campaigns
Multi-Agent Scan SCAN Active medium
38 IPs 33975 events
2026-10-01 — ongoing · 38 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 462370 events
2026-09-30 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 506396 events
2026-09-30 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 754100 events
2026-09-25 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 530875 events
2026-09-21 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
97 IPs 88019 events
2026-09-21 — ongoing · 97 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
209 IPs 906167 events
2026-09-14 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 936655 events
2026-09-14 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
197 IPs 849478 events
2026-09-09 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
249 IPs 949314 events
2026-05-29 — ongoing · 249 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 544537 events
2026-05-29 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
194 IPs 902073 events
2026-05-29 — ongoing · 194 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
37 IPs 47435 events
2026-05-29 — ongoing · 37 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 433373 events
2026-05-29 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
229 IPs 821543 events
2026-05-29 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
258 IPs 916376 events
2026-05-29 — ongoing · 258 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
96 IPs 254780 events
2026-05-29 — ongoing · 96 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 621385 events
2026-05-29 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
233 IPs 1006448 events
2026-05-29 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
103 IPs 259660 events
2026-05-22 — ongoing · 103 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 769003 events
2026-05-22 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
150 IPs 451308 events
2026-05-22 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 687590 events
2026-05-22 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
207 IPs 747812 events
2026-05-22 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
224 IPs 995732 events
2026-05-22 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 700766 events
2026-05-19 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
198 IPs 770176 events
2026-04-05 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
21 IPs 54941 events
2026-03-03 — ongoing · 21 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 495755 events
2026-03-03 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 1004805 events
2026-03-03 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 758764 events
2026-03-03 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 881056 events
2026-03-03 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
242 IPs 955105 events
2026-03-03 — ongoing · 242 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 889399 events
2026-03-03 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
162 IPs 675965 events
2026-03-01 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 928166 events
2026-03-01 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
231 IPs 649948 events
2026-02-28 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
215 IPs 723467 events
2026-02-26 — ongoing · 215 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 malware_dropper ×14 credential_probe ×38 opportunistic_bruter ×14
Sessions
67 (28 with login)
Avg Depth Score
0.43
Commands Executed
42
Files Downloaded
14
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe e2d9b0f58400 w4m_seattle_01 · 2026-10-11 07:04
1 20%
Loading events...
Malware Dropper 7561a79ddaea w4m_seattle_01 · 2026-10-11 07:03
3 1 1 100%
Loading events...
Opportunistic Bruter ebe8a93b586c w4m_seattle_01 · 2026-10-11 07:03
1 50%
Loading events...
Credential Probe 15216c987cd2 w4m_seattle_01 · 2026-10-11 07:03
1 20%
Loading events...
Malware Dropper 28f99d2cb088 w4m_seattle_01 · 2026-10-11 07:01
3 1 1 100%
Loading events...
Opportunistic Bruter f58251c23a3f w4m_seattle_01 · 2026-10-11 07:01
1 50%
Loading events...
Credential Probe 56c65af940fe w4m_seattle_01 · 2026-10-11 07:01
1 20%
Loading events...
Credential Probe 0119c9ccffc9 w4m_seattle_01 · 2026-10-11 06:59
1 20%
Loading events...
Opportunistic Bruter 50e0de9c41ae w4m_seattle_01 · 2026-10-11 06:58
1 50%
Loading events...
Malware Dropper ba5a62ceef00 w4m_seattle_01 · 2026-10-11 06:58
3 1 1 100%
Loading events...
Credential Probe af7236e72535 w4m_seattle_01 · 2026-10-11 06:58
1 20%
Loading events...
Credential Probe 9aba329e6699 w4m_seattle_01 · 2026-10-11 06:56
1 20%
Loading events...
Credential Probe 4faa19094584 w4m_seattle_01 · 2026-10-11 06:55
1 20%
Loading events...
Credential Probe 5e097a5598ff w4m_seattle_01 · 2026-10-11 06:53
1 20%
Loading events...
Credential Probe 680ea9b458ed w4m_seattle_01 · 2026-10-11 06:52
1 20%
Loading events...
Credential Probe b8270083d90f w4m_seattle_01 · 2026-10-11 06:50
1 20%
Loading events...
Credential Probe 80e36e9ae25e w4m_seattle_01 · 2026-10-11 06:48
1 20%
Loading events...
Credential Probe 9c39032450f7 w4m_seattle_01 · 2026-10-11 06:47
1 20%
Loading events...
Credential Probe ef3e199e55a7 w4m_seattle_01 · 2026-10-11 06:45
1 20%
Loading events...
Malware Dropper 3eee351d38c9 w4m_seattle_01 · 2026-10-11 06:44
3 1 1 100%
Loading events...
Opportunistic Bruter 1f40222ff23a w4m_seattle_01 · 2026-10-11 06:44
1 50%
Loading events...
Credential Probe 827137b2e071 w4m_seattle_01 · 2026-10-11 06:44
1 20%
Loading events...
Opportunistic Bruter 950601caddbe w4m_seattle_01 · 2026-10-11 06:42
1 50%
Loading events...
Malware Dropper ff4bf2d77d6d w4m_seattle_01 · 2026-10-11 06:42
3 1 1 100%
Loading events...
Credential Probe 21b73561dae0 w4m_seattle_01 · 2026-10-11 06:42
1 20%
Loading events...
Credential Probe 2770ce908692 w4m_seattle_01 · 2026-10-11 06:41
1 20%
Loading events...
Credential Probe e045751e193e w4m_seattle_01 · 2026-10-11 06:39
1 20%
Loading events...
Opportunistic Bruter 7f5e8e3710fa w4m_seattle_01 · 2026-10-11 06:37
1 50%
Loading events...
Malware Dropper 3caf2418586f w4m_seattle_01 · 2026-10-11 06:37
3 1 1 100%
Loading events...
Credential Probe 4e60114272e8 w4m_seattle_01 · 2026-10-11 06:37
1 20%
Loading events...
Credential Probe 102048f5d3ef w4m_seattle_01 · 2026-10-11 06:35
1 20%
Loading events...
Credential Probe 62d0e5e59946 w4m_seattle_01 · 2026-10-11 06:32
1 20%
Loading events...
Credential Probe 1d9d3a769983 newark_01 · 2026-10-09 17:06
1 20%
Loading events...
Credential Probe 446ebbfc8cf6 newark_01 · 2026-10-09 17:05
1 20%
Loading events...
Credential Probe bd057dbece08 newark_01 · 2026-10-09 17:03
1 20%
Loading events...
Credential Probe 1d740f10ecda newark_01 · 2026-10-09 17:02
1 20%
Loading events...
Scanner 4c50a71c348b newark_01 · 2026-10-09 17:00
15%
Loading events...
Opportunistic Bruter 13b6cc344495 newark_01 · 2026-10-09 16:58
1 50%
Loading events...
Malware Dropper 2ad73ea97510 newark_01 · 2026-10-09 16:58
3 1 1 100%
Loading events...
Credential Probe c7f8126d8b4c newark_01 · 2026-10-09 16:58
1 20%
Loading events...
Opportunistic Bruter 5f2fcb2f2959 newark_01 · 2026-10-09 16:57
1 50%
Loading events...
Malware Dropper af81a0431e85 newark_01 · 2026-10-09 16:57
3 1 1 100%
Loading events...
Credential Probe 825c5592fa32 newark_01 · 2026-10-09 16:57
1 20%
Loading events...
Opportunistic Bruter 82d89f5bb9cd newark_01 · 2026-10-09 16:55
1 50%
Loading events...
Malware Dropper f7832b8f69ef newark_01 · 2026-10-09 16:55
3 1 1 100%
Loading events...
Credential Probe afcd3418529d newark_01 · 2026-10-09 16:55
1 20%
Loading events...
Opportunistic Bruter 16afdd1df5de newark_01 · 2026-10-09 16:54
1 50%
Loading events...
Malware Dropper e497727939ea newark_01 · 2026-10-09 16:53
3 1 1 100%
Loading events...
Credential Probe e99c75034de6 newark_01 · 2026-10-09 16:54
1 20%
Loading events...
Opportunistic Bruter 8ed599f74346 newark_01 · 2026-10-09 16:52
1 50%
Loading events...