IntrusionLabs IntrusionLabs
← Back to feed

20.244.28.141

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
54%
Assessment
SSH password brute-forcer
  • Ran 72 commands on the host.
  • Active for 10 days, 2026-09-19 to 2026-09-30.
  • Part of a 165-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇮🇳 IN / Pune
ASN
AS8075 · Microsoft Corporation
Cloud Provider
Microsoft Azure
Total Events
144
Above average by volume
Agent Count
2
First / Last Seen
2026-09-19 08:14 — 2026-09-30 02:52
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion telnet:bruteforce telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1003.008 T1110 T1110.001
Discovery
T1046 T1083
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
149 IPs 375955 events
2026-09-08 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
110 IPs 361513 events
2026-09-08 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 382096 events
2026-09-08 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
144 IPs 347983 events
2026-09-08 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 369529 events
2026-09-08 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
134 IPs 342317 events
2026-09-08 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
105 IPs 237296 events
2026-08-26 — ongoing · 105 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 289458 events
2026-06-11 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Vultr. Scanning the same …
Multi-Agent Scan SCAN Active medium
137 IPs 351747 events
2026-05-22 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
87 IPs 287207 events
2026-05-22 — ongoing · 87 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
48 IPs 37079 events
2026-05-22 — ongoing · 48 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
80 IPs 108159 events
2026-04-27 — ongoing · 80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
85 IPs 269499 events
2026-04-06 — ongoing · 85 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 442748 events
2026-03-22 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
119 IPs 403220 events
2026-03-22 — ongoing · 119 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 366319 events
2026-03-22 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
113 IPs 182901 events
2026-03-18 — ongoing · 113 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
84 IPs 328199 events
2026-03-07 — ongoing · 84 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 414591 events
2026-03-05 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
95 IPs 81074 events
2026-03-05 — ongoing · 95 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
125 IPs 363673 events
2026-03-05 — ongoing · 125 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
158 IPs 366244 events
2026-03-05 — ongoing · 158 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 412895 events
2026-03-05 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 396350 events
2026-03-05 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
101 IPs 96654 events
2026-03-05 — ongoing · 101 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
144 IPs 359237 events
2026-03-05 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
100 IPs 76401 events
2026-03-03 — ongoing · 100 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
146 IPs 387736 events
2026-03-02 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 411360 events
2026-02-28 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
97 IPs 236664 events
2026-02-28 — ongoing · 97 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
55 IPs 25059 events
2026-02-27 — ongoing · 55 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
131 IPs 333303 events
2026-02-26 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
5 IPs 384 events
2026-02-26 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
145 IPs 352395 events
2026-02-26 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
145 IPs 396208 events
2026-02-26 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
95 IPs 295784 events
2026-02-26 — ongoing · 95 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
156 IPs 400815 events
2026-02-24 — ongoing · 156 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 credential_probe ×8 interactive_operator ×3
Sessions
12 (3 with login)
Avg Depth Score
0.37
Commands Executed
72
Files Downloaded
0
Notable Commands
  • id
  • cat /etc/passwd
  • echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
  • enable
  • system
  • system
  • shell
  • shell
  • sh
  • bash
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
19532158b559096b89b1a5f7d17175b2
SSH Client
SSH-2.0-libssh2_1.11.1
Evidence Timeline
Interactive Operator 72c4fbfdda4e w4m_singapore_01 · 2026-09-30 02:49
24 1 90%
Loading events...
Credential Probe 1e694c87ae46 w4m_singapore_01 · 2026-09-30 02:49
1 20%
Loading events...
Credential Probe 596ae32e967b w4m_singapore_01 · 2026-09-30 02:49
1 20%
Loading events...
Interactive Operator 68a834055f09 w4m_singapore_01 · 2026-09-20 16:45
24 1 90%
Loading events...
Credential Probe 05d2599c2eee w4m_singapore_01 · 2026-09-20 16:45
1 20%
Loading events...
Credential Probe 2f665feae108 w4m_singapore_01 · 2026-09-20 16:45
1 20%
Loading events...
Scanner 5bcc7e25abe4 newark_01 · 2026-09-19 19:49
15%
Loading events...
Credential Probe fafda3cf528f newark_01 · 2026-09-19 19:48
1 20%
Loading events...
Credential Probe 9efb7b67c7e4 newark_01 · 2026-09-19 19:48
1 20%
Loading events...
Interactive Operator 4adad5bb172c newark_01 · 2026-09-19 08:14
24 1 90%
Loading events...
Credential Probe 8a6a2d1ee6c1 newark_01 · 2026-09-19 08:14
1 20%
Loading events...
Credential Probe aed411603295 newark_01 · 2026-09-19 08:14
1 20%
Loading events...