IntrusionLabs IntrusionLabs
← Back to feed

223.188.66.20

TAGGED SUSPICIOUS how we decide →
Threat Confidence
36%
Location
🇮🇳 IN
ASN
AS45609 · Bharti Airtel Ltd. AS for GPRS Service
Cloud Provider
—
Total Events
76
Above average by volume
Agent Count
1
First / Last Seen
2026-06-11 08:36 — 2026-06-11 10:38
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×1 reconnaissance ×1 credential_probe ×9 interactive_operator ×1
Sessions
12 (2 with login)
Avg Depth Score
0.29
Commands Executed
8
Files Downloaded
0
Notable Commands
  • cat /dev/null > /var/log/auth.log 2>/dev/null; cat /dev/null > /var/log/messages 2>/dev/null
  • (while true; do wget -q --no-check-certificate -O - https://opluscowork.com >/dev/null 2>&1; sleep 1; done) >/dev/null 2>&1 &
  • while true
  • do wget -q --no-check-certificate -O - https://opluscowork.com > /dev/null 2 >& 1
  • sleep 1
  • done
  • &
Fingerprints
HASSH
eeca2460550b9ded084ecf2f70a75356
SSH Client
SSH-2.0-OpenSSH_10.3p1 Debian-2
Evidence Timeline
Credential Probe 6d9a3c6ff4a0 newark_01 · 2026-06-11 10:37
1 20%
Loading events...
Scanner 8673b6b80e3c newark_01 · 2026-06-11 10:37
15%
Loading events...
Credential Probe 424444beaeea newark_01 · 2026-06-11 10:22
1 20%
Loading events...
Credential Probe 3f6a5cdcaaa4 newark_01 · 2026-06-11 10:18
1 20%
Loading events...
Credential Probe 71989c5d90ca newark_01 · 2026-06-11 09:55
1 20%
Loading events...
Credential Probe 176894c5455f newark_01 · 2026-06-11 09:31
1 20%
Loading events...
Credential Probe 8777276adf36 newark_01 · 2026-06-11 09:30
1 20%
Loading events...
Credential Probe aa0af0fb511e newark_01 · 2026-06-11 09:26
1 20%
Loading events...
Reconnaissance 93a64166d2cf newark_01 · 2026-06-11 09:05
1 1 60%
Loading events...
Interactive Operator a0d6706d286d newark_01 · 2026-06-11 09:04
7 1 90%
Loading events...
Credential Probe bbb83dd22a8e newark_01 · 2026-06-11 08:43
1 20%
Loading events...
Credential Probe 9b34639ecab5 newark_01 · 2026-06-11 08:36
1 20%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}