IntrusionLabs IntrusionLabs
← Back to feed

202.6.200.210

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
200-210.amanadigital.net (amanadigital.net) ✗ FCrDNS
Threat Confidence
51%
Assessment
SSH password brute-forcer
  • Logged in with 20 different credentials across 38 logins.
  • Downloaded 19 files and ran 57 commands on the host.
  • Part of a 165-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇮🇩 ID / Tangerang
ASN
AS139640 · PT Amana Digital Nusantara
Cloud Provider
—
Total Events
542
Top 10% by volume
Agent Count
2
First / Last Seen
2026-09-21 15:46 — 2026-09-21 19:17
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
148 IPs 382890 events
2026-09-14 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
74 IPs 262108 events
2026-09-14 — ongoing · 74 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
37 IPs 173638 events
2026-09-14 — ongoing · 37 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
83 IPs 219468 events
2026-09-04 — ongoing · 83 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 402966 events
2026-07-28 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
92 IPs 173574 events
2026-07-01 — ongoing · 92 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
109 IPs 88024 events
2026-06-09 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
136 IPs 367224 events
2026-05-19 — ongoing · 136 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
159 IPs 381203 events
2026-04-15 — ongoing · 159 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
154 IPs 382507 events
2026-03-31 — ongoing · 154 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
118 IPs 313086 events
2026-03-31 — ongoing · 118 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
85 IPs 121472 events
2026-03-31 — ongoing · 85 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 295155 events
2026-03-31 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
32 IPs 13700 events
2026-03-21 — ongoing · 32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
46 IPs 90465 events
2026-03-21 — ongoing · 46 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 401331 events
2026-03-16 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
115 IPs 314249 events
2026-03-10 — ongoing · 115 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
144 IPs 327071 events
2026-03-08 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 415775 events
2026-03-05 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
107 IPs 81000 events
2026-03-05 — ongoing · 107 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
128 IPs 398457 events
2026-03-05 — ongoing · 128 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 435063 events
2026-03-05 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
124 IPs 68687 events
2026-03-05 — ongoing · 124 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
44 IPs 36219 events
2026-03-05 — ongoing · 44 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
127 IPs 335748 events
2026-03-01 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
9 IPs 2655 events
2026-02-27 — ongoing · 9 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×19 credential_probe ×40 opportunistic_bruter ×19
Sessions
78 (38 with login)
Avg Depth Score
0.47
Commands Executed
57
Files Downloaded
19
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe 1d3e05dd1f4c w4m_seattle_01 · 2026-09-21 19:17
1 20%
Loading events...
Opportunistic Bruter 0114e4e4fc7e w4m_seattle_01 · 2026-09-21 19:15
1 50%
Loading events...
Malware Dropper b4403310224c w4m_seattle_01 · 2026-09-21 19:15
3 1 1 100%
Loading events...
Credential Probe e60fd8e2fff2 w4m_seattle_01 · 2026-09-21 19:15
1 20%
Loading events...
Opportunistic Bruter 3ac7c9d40aed w4m_seattle_01 · 2026-09-21 19:14
1 50%
Loading events...
Credential Probe f71e32dfdc85 w4m_seattle_01 · 2026-09-21 19:13
1 20%
Loading events...
Malware Dropper dbaeea0fbc55 w4m_seattle_01 · 2026-09-21 19:13
3 1 1 100%
Loading events...
Opportunistic Bruter bc13c7896499 w4m_seattle_01 · 2026-09-21 19:12
1 50%
Loading events...
Malware Dropper c17a643399fd w4m_seattle_01 · 2026-09-21 19:12
3 1 1 100%
Loading events...
Credential Probe 9c75d5af7857 w4m_seattle_01 · 2026-09-21 19:12
1 20%
Loading events...
Credential Probe c9810d6103cd w4m_seattle_01 · 2026-09-21 19:10
1 20%
Loading events...
Opportunistic Bruter 274074d52feb w4m_seattle_01 · 2026-09-21 19:09
1 50%
Loading events...
Malware Dropper 0001b52500f9 w4m_seattle_01 · 2026-09-21 19:08
3 1 1 100%
Loading events...
Credential Probe 17f9d07e2b27 w4m_seattle_01 · 2026-09-21 19:09
1 20%
Loading events...
Opportunistic Bruter abe4960c7915 w4m_seattle_01 · 2026-09-21 19:07
1 50%
Loading events...
Malware Dropper 63518f65807d w4m_seattle_01 · 2026-09-21 19:07
3 1 1 100%
Loading events...
Credential Probe cf0302c9a56f w4m_seattle_01 · 2026-09-21 19:07
1 20%
Loading events...
Credential Probe 34de06336ed6 w4m_seattle_01 · 2026-09-21 19:05
1 20%
Loading events...
Credential Probe abe950ab7bae w4m_seattle_01 · 2026-09-21 19:04
1 20%
Loading events...
Opportunistic Bruter 82a14c46de9f w4m_seattle_01 · 2026-09-21 19:02
1 50%
Loading events...
Malware Dropper d0eecb3ec099 w4m_seattle_01 · 2026-09-21 19:02
3 1 1 100%
Loading events...
Credential Probe 9a308e5e1624 w4m_seattle_01 · 2026-09-21 19:02
1 20%
Loading events...
Credential Probe 435a61b78b14 w4m_seattle_01 · 2026-09-21 19:00
1 20%
Loading events...
Credential Probe 972e04479e14 w4m_seattle_01 · 2026-09-21 18:58
1 20%
Loading events...
Opportunistic Bruter d37c2ba02b45 w4m_seattle_01 · 2026-09-21 18:57
1 50%
Loading events...
Malware Dropper f55d1238b597 w4m_seattle_01 · 2026-09-21 18:57
3 1 1 100%
Loading events...
Credential Probe 773d6a3b6d3c w4m_seattle_01 · 2026-09-21 18:57
1 20%
Loading events...
Opportunistic Bruter 79d51b51aa81 w4m_seattle_01 · 2026-09-21 18:55
1 50%
Loading events...
Malware Dropper 18ffff155e93 w4m_seattle_01 · 2026-09-21 18:55
3 1 1 100%
Loading events...
Credential Probe 08920ee3a65e w4m_seattle_01 · 2026-09-21 18:55
1 20%
Loading events...
Credential Probe 7c0e95a017a8 w4m_seattle_01 · 2026-09-21 18:54
1 20%
Loading events...
Opportunistic Bruter aad73127f9a3 w4m_seattle_01 · 2026-09-21 18:52
1 50%
Loading events...
Malware Dropper f52d4269e56c w4m_seattle_01 · 2026-09-21 18:52
3 1 1 100%
Loading events...
Credential Probe 333b4f62e9da w4m_seattle_01 · 2026-09-21 18:52
1 20%
Loading events...
Credential Probe 4a14822471bb w4m_seattle_01 · 2026-09-21 18:50
1 20%
Loading events...
Malware Dropper e8e3aa88de06 w4m_seattle_01 · 2026-09-21 18:49
3 1 1 100%
Loading events...
Opportunistic Bruter 882ce85cdf6e w4m_seattle_01 · 2026-09-21 18:49
1 50%
Loading events...
Credential Probe fab9ef04d8af w4m_seattle_01 · 2026-09-21 18:49
1 20%
Loading events...
Opportunistic Bruter 53f8df92076c w4m_seattle_01 · 2026-09-21 18:47
1 50%
Loading events...
Malware Dropper acea5432ed11 w4m_seattle_01 · 2026-09-21 18:47
3 1 1 100%
Loading events...
Credential Probe 9c98492cbbc9 w4m_seattle_01 · 2026-09-21 18:47
1 20%
Loading events...
Credential Probe 838ad47437e3 w4m_seattle_01 · 2026-09-21 18:40
1 20%
Loading events...
Credential Probe 82e2bf53ca15 w4m_singapore_01 · 2026-09-21 16:28
1 20%
Loading events...
Credential Probe 8a3f67b1a83c w4m_singapore_01 · 2026-09-21 16:26
1 20%
Loading events...
Credential Probe e05b9b1a157e w4m_singapore_01 · 2026-09-21 16:25
1 20%
Loading events...
Credential Probe 81fc4b6f8469 w4m_singapore_01 · 2026-09-21 16:23
1 20%
Loading events...
Credential Probe 1a87d2a5be1c w4m_singapore_01 · 2026-09-21 16:21
1 20%
Loading events...
Opportunistic Bruter c0923078ff03 w4m_singapore_01 · 2026-09-21 16:19
1 50%
Loading events...
Malware Dropper 82d91a14b86b w4m_singapore_01 · 2026-09-21 16:19
3 1 1 100%
Loading events...
Credential Probe b60566df4562 w4m_singapore_01 · 2026-09-21 16:19
1 20%
Loading events...