IntrusionLabs IntrusionLabs
← Back to feed

213.206.207.146

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
50%
Assessment
SSH password brute-forcer
  • Logged in with 13 different credentials across 23 logins.
  • Downloaded 10 files and ran 35 commands on the host.
  • Active for 11 days, 2026-09-19 to 2026-10-01.
  • Part of a 263-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇳🇱 NL / Wehl
ASN
AS9150 · ML Consultancy
Cloud Provider
—
Total Events
326
Top 10% by volume
Agent Count
2
First / Last Seen
2026-09-19 10:59 — 2026-10-01 05:05
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
113 IPs 335146 events
2026-09-26 — ongoing · 113 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 334981 events
2026-09-26 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
231 IPs 588031 events
2026-09-24 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 470189 events
2026-09-24 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
263 IPs 682982 events
2026-09-17 — ongoing · 263 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
105 IPs 54646 events
2026-09-17 — ongoing · 105 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
154 IPs 344593 events
2026-09-14 — ongoing · 154 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 474111 events
2026-09-14 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
144 IPs 416973 events
2026-09-11 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
134 IPs 322020 events
2026-09-01 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
133 IPs 441336 events
2026-07-28 — ongoing · 133 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
75 IPs 133656 events
2026-07-04 — ongoing · 75 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
93 IPs 102073 events
2026-07-04 — ongoing · 93 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
109 IPs 118262 events
2026-06-28 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
88 IPs 69568 events
2026-06-28 — ongoing · 88 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
114 IPs 337775 events
2026-06-16 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
141 IPs 337908 events
2026-05-28 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
134 IPs 403626 events
2026-05-27 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
197 IPs 545680 events
2026-05-27 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
156 IPs 388103 events
2026-05-25 — ongoing · 156 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 382375 events
2026-05-16 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
184 IPs 467385 events
2026-05-07 — ongoing · 184 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
232 IPs 659179 events
2026-04-23 — ongoing · 232 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 560728 events
2026-04-22 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
217 IPs 524708 events
2026-04-20 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 519697 events
2026-04-16 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 142158 events
2026-04-16 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
207 IPs 518210 events
2026-04-16 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
156 IPs 523936 events
2026-04-15 — ongoing · 156 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
167 IPs 181042 events
2026-04-15 — ongoing · 167 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 459125 events
2026-04-15 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
220 IPs 524439 events
2026-04-15 — ongoing · 220 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
145 IPs 462332 events
2026-03-31 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 463052 events
2026-03-31 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
186 IPs 494418 events
2026-03-31 — ongoing · 186 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
195 IPs 533419 events
2026-03-31 — ongoing · 195 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 410578 events
2026-03-31 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
204 IPs 554476 events
2026-03-31 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 397242 events
2026-03-31 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
144 IPs 430417 events
2026-03-31 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
159 IPs 415072 events
2026-03-31 — ongoing · 159 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
142 IPs 207914 events
2026-03-31 — ongoing · 142 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 353307 events
2026-03-31 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 718043 events
2026-03-26 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 627511 events
2026-03-26 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 576953 events
2026-03-26 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
244 IPs 332239 events
2026-03-26 — ongoing · 244 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 710316 events
2026-03-26 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 563656 events
2026-03-26 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
128 IPs 266448 events
2026-03-22 — ongoing · 128 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
178 IPs 430435 events
2026-03-16 — ongoing · 178 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 413363 events
2026-03-16 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
221 IPs 533434 events
2026-03-13 — ongoing · 221 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
179 IPs 487869 events
2026-03-13 — ongoing · 179 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
174 IPs 387980 events
2026-03-10 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 379417 events
2026-03-04 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
206 IPs 537723 events
2026-03-01 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
134 IPs 471958 events
2026-03-01 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
187 IPs 549486 events
2026-03-01 — ongoing · 187 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
159 IPs 386387 events
2026-03-01 — ongoing · 159 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 547771 events
2026-02-28 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
76 IPs 31752 events
2026-02-26 — ongoing · 76 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
213 IPs 436112 events
2026-02-26 — ongoing · 213 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 401399 events
2026-02-23 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×2 reconnaissance ×2 malware_dropper ×10 credential_probe ×21 opportunistic_bruter ×11
Sessions
46 (23 with login)
Avg Depth Score
0.46
Commands Executed
35
Files Downloaded
10
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Opportunistic Bruter e0eca51147c1 newark_01 · 2026-10-01 05:05
1 50%
Loading events...
Malware Dropper f06aa766bac4 newark_01 · 2026-10-01 05:05
3 1 1 100%
Loading events...
Credential Probe 3508393a272d newark_01 · 2026-10-01 05:05
1 20%
Loading events...
Opportunistic Bruter bf629d86519a w4m_seattle_01 · 2026-09-25 12:48
1 50%
Loading events...
Malware Dropper a66ffb7ede32 w4m_seattle_01 · 2026-09-25 12:48
3 1 1 100%
Loading events...
Credential Probe 2761c127d623 w4m_seattle_01 · 2026-09-25 12:48
1 20%
Loading events...
Credential Probe 750429d7801c newark_01 · 2026-09-19 11:27
1 20%
Loading events...
Opportunistic Bruter 23ea0e4cb007 newark_01 · 2026-09-19 11:25
1 50%
Loading events...
Credential Probe 15d7720cf463 newark_01 · 2026-09-19 11:25
1 20%
Loading events...
Reconnaissance cc355d56b841 newark_01 · 2026-09-19 11:25
3 1 60%
Loading events...
Credential Probe 272a85193291 newark_01 · 2026-09-19 11:24
1 20%
Loading events...
Opportunistic Bruter 5b1726261c11 newark_01 · 2026-09-19 11:23
1 50%
Loading events...
Scanner d29784af1787 newark_01 · 2026-09-19 11:23
15%
Loading events...
Malware Dropper f219902392bb newark_01 · 2026-09-19 11:23
3 1 1 100%
Loading events...
Credential Probe 5e4416d69b01 newark_01 · 2026-09-19 11:22
1 20%
Loading events...
Opportunistic Bruter 93263d6094de newark_01 · 2026-09-19 11:21
1 50%
Loading events...
Malware Dropper 19dc67ec54a7 newark_01 · 2026-09-19 11:21
3 1 1 100%
Loading events...
Credential Probe 01618c8b7c3b newark_01 · 2026-09-19 11:21
1 20%
Loading events...
Credential Probe 5d068e5c4460 newark_01 · 2026-09-19 11:20
1 20%
Loading events...
Opportunistic Bruter 877da71e292a newark_01 · 2026-09-19 11:18
1 50%
Loading events...
Credential Probe 81b54f36f3bf newark_01 · 2026-09-19 11:18
1 20%
Loading events...
Malware Dropper daee96bc0b37 newark_01 · 2026-09-19 11:18
3 1 1 100%
Loading events...
Credential Probe 9f7a962338eb newark_01 · 2026-09-19 11:17
1 20%
Loading events...
Credential Probe 84cf67349996 newark_01 · 2026-09-19 11:16
1 20%
Loading events...
Opportunistic Bruter e450cbe97b89 newark_01 · 2026-09-19 11:15
1 50%
Loading events...
Malware Dropper 80ad970bb4d1 newark_01 · 2026-09-19 11:15
3 1 1 100%
Loading events...
Credential Probe f2e9a1eabc2e newark_01 · 2026-09-19 11:15
1 20%
Loading events...
Opportunistic Bruter b03b8d6bb32a newark_01 · 2026-09-19 11:14
1 50%
Loading events...
Malware Dropper f3a6bfd3c0ce newark_01 · 2026-09-19 11:14
3 1 1 100%
Loading events...
Credential Probe e3442b0c76bd newark_01 · 2026-09-19 11:14
1 20%
Loading events...
Credential Probe 3fb8b3df4342 newark_01 · 2026-09-19 11:13
1 20%
Loading events...
Opportunistic Bruter a454bf0a36ee newark_01 · 2026-09-19 11:12
1 50%
Loading events...
Credential Probe 624d466f68e0 newark_01 · 2026-09-19 11:12
1 20%
Loading events...
Reconnaissance e6c94feb96d1 newark_01 · 2026-09-19 11:12
2 1 60%
Loading events...
Opportunistic Bruter c1e36e3a953d newark_01 · 2026-09-19 11:11
1 50%
Loading events...
Malware Dropper b60a8c8a9cd3 newark_01 · 2026-09-19 11:11
3 1 1 100%
Loading events...
Credential Probe c954d1f044a7 newark_01 · 2026-09-19 11:11
1 20%
Loading events...
Credential Probe bca4b3d7813f newark_01 · 2026-09-19 11:10
1 20%
Loading events...
Scanner 0683d23d47db newark_01 · 2026-09-19 11:09
15%
Loading events...
Credential Probe 49db70a4818e newark_01 · 2026-09-19 11:08
1 20%
Loading events...
Malware Dropper 5e3f651b11e2 newark_01 · 2026-09-19 11:08
3 1 1 100%
Loading events...
Opportunistic Bruter a160cb3f45d4 newark_01 · 2026-09-19 11:07
1 50%
Loading events...
Malware Dropper 51b9104e5e0c newark_01 · 2026-09-19 11:07
3 1 1 100%
Loading events...
Credential Probe 442cf451108e newark_01 · 2026-09-19 11:07
1 20%
Loading events...
Credential Probe 949de861148e newark_01 · 2026-09-19 11:06
1 20%
Loading events...
Credential Probe fab38144dd49 newark_01 · 2026-09-19 10:59
1 20%
Loading events...