IntrusionLabs IntrusionLabs
← Back to feed

213.209.159.48

TAGGED SUSPICIOUS how we decide →
Why: Network is on the Spamhaus ASN-DROP list, with 32 events seen by our sensors · certainty: inferred
Threat Confidence
71%
Assessment
Port and service scanner
  • Logged in with 58 different credentials across 71 logins.
  • Downloaded 1 files and ran 55 commands on the host.
  • Active for 25 days, 2026-09-22 to 2026-10-18.
  • Part of a 274-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇩🇪 DE / Aachen
ASN
AS208137 · Feo Prest SRL
Cloud Provider
—
Total Events
787
Top 5% by volume
Agent Count
2
First / Last Seen
2026-09-22 21:50 — 2026-10-18 08:46
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion ssh:malware telnet:bruteforce telnet:connection telnet:intrusion telnet:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
201 IPs 746162 events
2026-10-11 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
74 IPs 62390 events
2026-10-04 — ongoing · 74 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
187 IPs 734158 events
2026-10-01 — ongoing · 187 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
73 IPs 316457 events
2026-10-01 — ongoing · 73 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 763077 events
2026-09-29 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
179 IPs 737926 events
2026-09-29 — ongoing · 179 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
52 IPs 54594 events
2026-09-26 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
182 IPs 656766 events
2026-09-25 — ongoing · 182 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
52 IPs 25733 events
2026-09-24 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
244 IPs 944988 events
2026-09-24 — ongoing · 244 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 770260 events
2026-09-24 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 583865 events
2026-09-23 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
241 IPs 899891 events
2026-09-16 — ongoing · 241 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 696407 events
2026-09-14 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 383221 events
2026-06-09 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
73 IPs 74036 events
2026-06-03 — ongoing · 73 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 269295 events
2026-06-03 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 376963 events
2026-05-27 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
110 IPs 473472 events
2026-04-20 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 671667 events
2026-03-21 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 163164 events
2026-03-21 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 676970 events
2026-03-21 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 618504 events
2026-03-21 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
160 IPs 741409 events
2026-03-21 — ongoing · 160 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
224 IPs 812091 events
2026-03-19 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
274 IPs 1029231 events
2026-03-19 — ongoing · 274 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
206 IPs 751766 events
2026-03-09 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
229 IPs 811798 events
2026-03-09 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 865623 events
2026-03-09 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
176 IPs 511887 events
2026-03-04 — ongoing · 176 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
190 IPs 760651 events
2026-03-03 — ongoing · 190 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
36 IPs 18661 events
2026-03-02 — ongoing · 36 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
256 IPs 868685 events
2026-03-02 — ongoing · 256 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
107 IPs 440218 events
2026-03-01 — ongoing · 107 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Subnet 213.209.159.0/24 SUBNET Active high 🇩🇪 DE
6 IPs 123175 events
mysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusiontelnet:malware
2026-02-16 — ongoing · 6 IPs from the same /24 subnet (213.209.159.0/24) were observed attacking our sensors within the same time window. …
Session Forensics
scanner ×73 reconnaissance ×54 malware_dropper ×1 credential_probe ×21 opportunistic_bruter ×16
Sessions
165 (71 with login)
Avg Depth Score
0.34
Commands Executed
55
Files Downloaded
1
Notable Commands
  • whoami
  • sh -s
Fingerprints
4 SSH client banners · 2 HASSH fingerprints
HASSH
30d88ae4c43d9ac31e09479b4204a646ade1080176ddf5fe289c863787061505
SSH Client
\xc6\xc2\xa5w\xa6\xfa\xbe\x83$=I\x84\x80\xf3!\x8d\xa3\x8a\xa2\xee,\x80"\x9e:\xa6\xfb\xae^DT\xd1 f2Sj{<\xcf `\xab\xd7w\x8c*1SSH-2.0-GoSSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19
Evidence Timeline
Credential Probe 6e1e69691aa8 newark_01 · 2026-10-18 08:46
1 20%
Loading events...
Opportunistic Bruter 9c76961d2bda newark_01 · 2026-10-18 08:46
1 50%
Loading events...
Credential Probe 354300d3fb89 newark_01 · 2026-10-18 08:46
1 20%
Loading events...
Credential Probe 54d189fd8bf0 newark_01 · 2026-10-18 08:45
1 20%
Loading events...
Credential Probe 946669957bd0 newark_01 · 2026-10-18 08:45
1 20%
Loading events...
Opportunistic Bruter 5a2c7f11bfa8 newark_01 · 2026-10-18 08:45
1 50%
Loading events...
Credential Probe a880ce13e48f newark_01 · 2026-10-18 08:45
1 20%
Loading events...
Opportunistic Bruter fe13013f0771 w4m_singapore_01 · 2026-10-17 11:53
1 50%
Loading events...
Opportunistic Bruter a58781798c7d w4m_singapore_01 · 2026-10-17 11:53
1 50%
Loading events...
Opportunistic Bruter 9162860dff2c w4m_singapore_01 · 2026-10-17 11:53
1 50%
Loading events...
Credential Probe 1c000f05e362 w4m_singapore_01 · 2026-10-17 11:53
1 20%
Loading events...
Scanner bc672039c9d2 w4m_singapore_01 · 2026-10-17 11:53
15%
Loading events...
Scanner 21a289a94d38 w4m_singapore_01 · 2026-10-17 11:53
15%
Loading events...
Reconnaissance 5aabd8df193a w4m_singapore_01 · 2026-10-17 11:53
1 1 60%
Loading events...
Reconnaissance b7461796cb0d w4m_singapore_01 · 2026-10-17 11:53
1 1 60%
Loading events...
Credential Probe 439317b2062e w4m_singapore_01 · 2026-10-17 11:53
1 20%
Loading events...
Scanner 61819a3d9424 w4m_singapore_01 · 2026-10-17 11:53
15%
Loading events...
Reconnaissance 9d6ea8d0feb6 w4m_singapore_01 · 2026-10-17 11:53
1 1 60%
Loading events...
Scanner f7acd034531f w4m_singapore_01 · 2026-10-17 11:53
15%
Loading events...
Reconnaissance 8a8b41b6c4d1 w4m_singapore_01 · 2026-10-17 11:53
1 1 60%
Loading events...
Reconnaissance e29c3857a69f w4m_singapore_01 · 2026-10-17 11:53
1 1 60%
Loading events...
Scanner 23520a6abba3 w4m_singapore_01 · 2026-10-17 11:53
15%
Loading events...
Credential Probe 9dceb6c7d259 w4m_singapore_01 · 2026-10-17 11:53
1 20%
Loading events...
Credential Probe 7fc8f7e2956c w4m_singapore_01 · 2026-10-17 11:53
1 20%
Loading events...
Credential Probe 4e8661fc7c6e w4m_singapore_01 · 2026-10-17 11:30
1 20%
Loading events...
Scanner f9604283a0a6 w4m_singapore_01 · 2026-10-17 11:30
15%
Loading events...
Reconnaissance 81f65c1d4d14 w4m_singapore_01 · 2026-10-17 11:30
1 1 60%
Loading events...
Reconnaissance 0a73bcc8ad94 w4m_singapore_01 · 2026-10-17 11:30
1 1 60%
Loading events...
Reconnaissance c465cdfceae3 w4m_singapore_01 · 2026-10-17 11:30
1 1 60%
Loading events...
Reconnaissance c8fdbaaa635a w4m_singapore_01 · 2026-10-17 11:30
1 1 60%
Loading events...
Scanner b691439624e4 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Scanner 3e7c12540e80 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Scanner 9ab0b659cbb5 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Opportunistic Bruter 1353c74839c5 w4m_singapore_01 · 2026-10-17 02:57
1 50%
Loading events...
Opportunistic Bruter b67cf97ebabd w4m_singapore_01 · 2026-10-17 02:57
1 50%
Loading events...
Opportunistic Bruter 7c810df46345 w4m_singapore_01 · 2026-10-17 02:57
1 50%
Loading events...
Scanner 69f5dfb481fc w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Scanner 83e180f84100 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Scanner 5a6bb4b546b1 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Scanner 1c79315dcd22 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Scanner 8d605623ca2d w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Opportunistic Bruter 37b8b1423f6a w4m_singapore_01 · 2026-10-17 02:57
1 50%
Loading events...
Reconnaissance 3b6cf1577f89 w4m_singapore_01 · 2026-10-17 02:57
1 1 60%
Loading events...
Scanner 38fe5ffc7f0d w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Credential Probe 1a143bb63a21 w4m_singapore_01 · 2026-10-17 02:56
1 20%
Loading events...
Scanner 88f709f93301 w4m_singapore_01 · 2026-10-17 02:57
15%
Loading events...
Reconnaissance 0084a6bc1bd7 w4m_singapore_01 · 2026-10-17 02:56
1 1 60%
Loading events...
Reconnaissance 0c3914cce606 w4m_singapore_01 · 2026-10-17 02:57
1 1 60%
Loading events...
Reconnaissance 5d23a3562a28 w4m_singapore_01 · 2026-10-17 02:56
1 1 60%
Loading events...
Reconnaissance afe3b7bd6f8b w4m_singapore_01 · 2026-10-17 02:56
1 1 60%
Loading events...