IntrusionLabs IntrusionLabs
← Back to feed

31.57.27.21

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
51%
Assessment
SSH password brute-forcer
  • Logged in with 19 different credentials across 36 logins.
  • Downloaded 18 files and ran 54 commands on the host.
  • Part of a 264-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇱🇻 LV / Riga
ASN
AS56971 · Cgi Global Limited
Cloud Provider
—
Total Events
524
Top 10% by volume
Agent Count
2
First / Last Seen
2026-10-01 06:10 — 2026-10-03 12:31
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
233 IPs 695804 events
2026-10-01 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
151 IPs 617795 events
2026-10-01 — ongoing · 151 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
48 IPs 108552 events
2026-09-07 — ongoing · 48 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
189 IPs 465066 events
2026-09-07 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 558440 events
2026-09-05 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
21 IPs 68368 events
2026-08-31 — ongoing · 21 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 416944 events
2026-08-17 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 200350 events
2026-06-09 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
217 IPs 716209 events
2026-05-16 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 767752 events
2026-05-06 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
131 IPs 136621 events
2026-05-06 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 759893 events
2026-04-15 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
74 IPs 88460 events
2026-04-15 — ongoing · 74 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
261 IPs 678904 events
2026-04-15 — ongoing · 261 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
201 IPs 655679 events
2026-04-15 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
225 IPs 679549 events
2026-04-15 — ongoing · 225 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
217 IPs 708401 events
2026-04-15 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
172 IPs 587015 events
2026-04-15 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
214 IPs 653306 events
2026-04-15 — ongoing · 214 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
234 IPs 716887 events
2026-04-15 — ongoing · 234 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 693438 events
2026-04-15 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
224 IPs 645020 events
2026-04-15 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
260 IPs 788883 events
2026-04-15 — ongoing · 260 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
110 IPs 486767 events
2026-03-31 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 465460 events
2026-03-21 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
134 IPs 209652 events
2026-03-21 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
14 IPs 87907 events
2026-03-18 — ongoing · 14 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
31 IPs 47635 events
2026-03-18 — ongoing · 31 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
131 IPs 546395 events
2026-03-18 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
201 IPs 595850 events
2026-03-10 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS56971 Cgi Global Limited ASN Ended medium 🇺🇸 US
5 IPs 1070 events
ssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:intrusion
2026-03-07 — 2026-08-14 · 5 IPs from the same network (Cgi Global Limited, AS56971) were active during overlapping time periods. Temporal correlation …
Multi-Agent Scan SCAN Active medium
264 IPs 713803 events
2026-03-07 — ongoing · 264 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
67 IPs 78106 events
2026-03-02 — ongoing · 67 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 677517 events
2026-03-01 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
178 IPs 301988 events
2026-03-01 — ongoing · 178 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
199 IPs 610035 events
2026-02-24 — ongoing · 199 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
198 IPs 605268 events
2026-02-24 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×18 credential_probe ×40 opportunistic_bruter ×18
Sessions
76 (36 with login)
Avg Depth Score
0.46
Commands Executed
54
Files Downloaded
18
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe 0214e82c5fff w4m_seattle_01 · 2026-10-03 12:31
1 20%
Loading events...
Credential Probe 7a61b5d6100e w4m_seattle_01 · 2026-10-03 12:30
1 20%
Loading events...
Credential Probe 6de44a656c56 w4m_seattle_01 · 2026-10-03 12:29
1 20%
Loading events...
Malware Dropper 31ff496af504 w4m_seattle_01 · 2026-10-03 12:27
3 1 1 100%
Loading events...
Opportunistic Bruter e7a88e3ef54c w4m_seattle_01 · 2026-10-03 12:27
1 50%
Loading events...
Credential Probe decd6be5c430 w4m_seattle_01 · 2026-10-03 12:27
1 20%
Loading events...
Credential Probe 6ac23eae6ab6 w4m_seattle_01 · 2026-10-03 12:26
1 20%
Loading events...
Opportunistic Bruter 6681110991ee w4m_seattle_01 · 2026-10-03 12:25
1 50%
Loading events...
Malware Dropper 00354f3efba6 w4m_seattle_01 · 2026-10-03 12:25
3 1 1 100%
Loading events...
Credential Probe 5cbb5e20a526 w4m_seattle_01 · 2026-10-03 12:25
1 20%
Loading events...
Malware Dropper ccce538eb579 w4m_seattle_01 · 2026-10-03 12:23
3 1 1 100%
Loading events...
Opportunistic Bruter e637a050b0fe w4m_seattle_01 · 2026-10-03 12:24
1 50%
Loading events...
Credential Probe 85a0fc21f553 w4m_seattle_01 · 2026-10-03 12:23
1 20%
Loading events...
Opportunistic Bruter 908e4e90ecaa w4m_seattle_01 · 2026-10-03 12:22
1 50%
Loading events...
Malware Dropper e37a4b3a97e0 w4m_seattle_01 · 2026-10-03 12:22
3 1 1 100%
Loading events...
Credential Probe 2b3f3a89e4de w4m_seattle_01 · 2026-10-03 12:22
1 20%
Loading events...
Malware Dropper 766eaefc61fb w4m_seattle_01 · 2026-10-03 12:21
3 1 1 100%
Loading events...
Opportunistic Bruter e0bfec5514db w4m_seattle_01 · 2026-10-03 12:21
1 50%
Loading events...
Credential Probe 4270a85c9f94 w4m_seattle_01 · 2026-10-03 12:21
1 20%
Loading events...
Credential Probe 91942853c2ef w4m_seattle_01 · 2026-10-03 12:19
1 20%
Loading events...
Malware Dropper 7d65ef34c8ee w4m_seattle_01 · 2026-10-03 12:18
3 1 1 100%
Loading events...
Opportunistic Bruter 51d53a6b7fd8 w4m_seattle_01 · 2026-10-03 12:18
1 50%
Loading events...
Credential Probe dcf4663f4538 w4m_seattle_01 · 2026-10-03 12:18
1 20%
Loading events...
Malware Dropper 9a41522b41ee w4m_seattle_01 · 2026-10-03 12:17
3 1 1 100%
Loading events...
Opportunistic Bruter 4943cefb248c w4m_seattle_01 · 2026-10-03 12:17
1 50%
Loading events...
Credential Probe 1c9049743cf3 w4m_seattle_01 · 2026-10-03 12:17
1 20%
Loading events...
Credential Probe 9ee160cf99f9 w4m_seattle_01 · 2026-10-03 12:16
1 20%
Loading events...
Credential Probe 7f89891d081c w4m_seattle_01 · 2026-10-03 12:14
1 20%
Loading events...
Credential Probe 72442099476e w4m_seattle_01 · 2026-10-03 12:13
1 20%
Loading events...
Credential Probe aa709d847ca5 w4m_seattle_01 · 2026-10-03 12:12
1 20%
Loading events...
Malware Dropper 75cba428115c w4m_seattle_01 · 2026-10-03 12:11
3 1 1 100%
Loading events...
Opportunistic Bruter 6bb736d6ecd3 w4m_seattle_01 · 2026-10-03 12:11
1 50%
Loading events...
Credential Probe f217e31c7cc8 w4m_seattle_01 · 2026-10-03 12:11
1 20%
Loading events...
Credential Probe 8f36c7c95ab0 w4m_seattle_01 · 2026-10-03 12:09
1 20%
Loading events...
Malware Dropper 26553136bbb9 w4m_seattle_01 · 2026-10-03 12:08
3 1 1 100%
Loading events...
Opportunistic Bruter 4bfe11acebf6 w4m_seattle_01 · 2026-10-03 12:08
1 50%
Loading events...
Credential Probe c89e53653de0 w4m_seattle_01 · 2026-10-03 12:08
1 20%
Loading events...
Credential Probe e3fd0c711f2c w4m_seattle_01 · 2026-10-03 12:04
1 20%
Loading events...
Malware Dropper 432714b92f54 w4m_singapore_01 · 2026-10-01 06:40
3 1 1 100%
Loading events...
Opportunistic Bruter 3a0fcdeeff93 w4m_singapore_01 · 2026-10-01 06:40
1 50%
Loading events...
Credential Probe 6d84f7a5b2f1 w4m_singapore_01 · 2026-10-01 06:40
1 20%
Loading events...
Credential Probe 253ca97886ab w4m_singapore_01 · 2026-10-01 06:39
1 20%
Loading events...
Credential Probe 4f207021cb8c w4m_singapore_01 · 2026-10-01 06:38
1 20%
Loading events...
Credential Probe 17a8b33f3c28 w4m_singapore_01 · 2026-10-01 06:36
1 20%
Loading events...
Credential Probe 914f0bf129ee w4m_singapore_01 · 2026-10-01 06:35
1 20%
Loading events...
Malware Dropper acb29adb82bb w4m_singapore_01 · 2026-10-01 06:34
3 1 1 100%
Loading events...
Opportunistic Bruter 8f99e116990f w4m_singapore_01 · 2026-10-01 06:34
1 50%
Loading events...
Credential Probe 5f56af724df4 w4m_singapore_01 · 2026-10-01 06:34
1 20%
Loading events...
Malware Dropper 29031d2ec194 w4m_singapore_01 · 2026-10-01 06:33
3 1 1 100%
Loading events...
Opportunistic Bruter 9e6ea884f043 w4m_singapore_01 · 2026-10-01 06:33
1 50%
Loading events...