IntrusionLabs IntrusionLabs
← Back to feed

40.65.58.130

TAGGED MALICIOUS how we decide →
Threat Confidence
69%
Location
🇺🇸 US / San Jose
ASN
AS8075 · Microsoft Corporation
Cloud Provider
Microsoft Azure
Total Events
699
Top 5% by volume
Agent Count
2
First / Last Seen
2026-02-25 15:46 — 2026-05-11 06:10
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001 T1552.003
Discovery
T1016 T1046 T1082 T1083
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-05-11 06:01
blocklist_de:reported
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×1 reconnaissance ×2 malware_dropper ×26 credential_probe ×1
Sessions
30 (28 with login)
Avg Depth Score
0.92
Commands Executed
470
Files Downloaded
26
Notable Commands
  • echo "===HOSTNAME==="; hostname 2>/dev/null || echo EMPTY;; echo "===UNAME==="; uname -a 2>/dev/null || echo EMPTY;; echo "===WHOAMI==="; whoami 2>/dev/null || echo EMPTY;; echo "===PWD==="; pwd 2>/dev/null || echo EMPTY;; echo "===LS_ROOT==="; ls -la / 2>/dev/null | head -10 || echo EMPTY;; echo "===PS==="; ps aux 2>/dev/null | head -15 || echo EMPTY;; echo "===NETSTAT==="; netstat -tulpn 2>/dev/null | head -10 || echo EMPTY;; echo "===HISTORY==="; history 2>/dev/null | tail -5 || echo EMPTY;; echo "===SSH_VERSION==="; ssh -V 2>&1 || echo EMPTY;; echo "===UPTIME==="; uptime 2>/dev/null || echo EMPTY;; echo "===MOUNT==="; mount 2>/dev/null | head -5 || echo EMPTY;; echo "===ENV==="; env 2>/dev/null | head -10 || echo EMPTY;; echo "===CPU_CORES==="; nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo 0;; echo "===ARCH==="; uname -m 2>/dev/null || echo unknown;; echo "===CPU_MODEL==="; grep 'model name' /proc/cpuinfo 2>/dev/null | head -1 | cut -d ':' -f2- | sed 's/^ *//' || echo unknown;; echo "===RESOURCES==="; echo MEMKB=$(awk '/MemTotal/{print $2}' /proc/meminfo 2>/dev/null) DISKKB=$(df / 2>/dev/null | awk 'NR==2{print $2}') USERCNT=$(wc -l < /etc/passwd 2>/dev/null) PKGCNT=$(dpkg -l 2>/dev/null | grep -c '^ii' || rpm -qa 2>/dev/null | wc -l || echo 0);; echo "===CONTAINER==="; cat /proc/1/cgroup 2>/dev/null | head -3; test -f /.dockerenv && echo DOCKERENV; test -f /run/.containerenv && echo CONTAINERENV; echo;; echo "===COWRIE==="; ls /opt/cowrie /home/richard /etc/cowrie 2>&1;; echo "===DMESG==="; dmesg 2>/dev/null | head -5 || echo EMPTY;; echo "===PORTS==="; ss -tulpn 2>/dev/null | grep LISTEN | head -20 || netstat -tulpn 2>/dev/null | grep LISTEN | head -20 || echo EMPTY;; echo "===NETCFG==="; ls -la /etc/network/interfaces /etc/sysconfig/network-scripts/ /etc/netplan/ 2>/dev/null | head -3 || echo EMPTY;; echo "===IPADDR==="; ip addr show 2>/dev/null | grep -E '^[0-9]+:' | head -5 || echo EMPTY;; echo "===IPROUTE==="; ip route show 2>/dev/null | head -3 || echo EMPTY;; echo "===WRITE==="; TF=/tmp/t_$$; echo test > $TF 2>&1 && echo WRITEOK && rm -f $TF || echo WRITEFAIL;; echo "===IDCHECK==="; id 2>/dev/null && echo IDOK || echo IDFAIL; whoami 2>/dev/null && echo WHOAMIOK || echo WHOAMIFAIL;; echo "===PKGMGR==="; which apt 2>/dev/null || which yum 2>/dev/null || which pacman 2>/dev/null || which zypper 2>/dev/null || echo NOPKG;; echo "===SERVICES==="; systemctl list-units --type=service --state=running 2>/dev/null | head -10 || echo NOSVC;; echo "===SOCKETS==="; ss -tuln 2>/dev/null | wc -l || echo 0;; echo "===GPU==="; nvidia-smi --query-gpu=name,memory.total,driver_version --format=csv,noheader 2>/dev/null || echo NOGPU;; echo "===MAXDISK==="; df -BG 2>/dev/null | awk 'NR>1{gsub("G","",$2); if($2+0>max) max=$2+0} END{print max+0}' || echo 0;; echo "===END==="
  • awk /MemTotal/{print $2} /proc/meminfo 2 > /dev/null
  • df / 2 > /dev/null | awk NR==2{print $2}
  • wc -l < /etc/passwd 2 > /dev/null
  • dpkg -l 2 > /dev/null | grep -c ^ii
  • dpkg -l
  • rpm -qa 2 > /dev/null | wc -l
  • rpm -qa
  • echo 0
  • sed s/^ *//
  • whoami
  • history | tail -5
Fingerprints
HASSH
16443846184eafde36765c9bab2f439741436928ad6c56162ccacb243cee8297
SSH Client
SSH-2.0-Go
Evidence Timeline
Malware Dropper 840668c153b8 w4m_singapore_01 · 2026-05-11 06:10
18 1 1 100%
Loading events...
Malware Dropper 37cc145c2691 w4m_singapore_01 · 2026-05-11 06:09
18 1 1 100%
Loading events...
Malware Dropper d531a70c72fd w4m_singapore_01 · 2026-05-11 06:06
18 1 1 100%
Loading events...
Malware Dropper fdc6604f218a w4m_singapore_01 · 2026-05-11 06:04
18 1 1 100%
Loading events...
Malware Dropper efdbb4ef7c3a w4m_singapore_01 · 2026-05-11 06:02
18 1 1 100%
Loading events...
Malware Dropper ce9b9f2f2ab7 w4m_singapore_01 · 2026-05-11 06:01
18 1 1 100%
Loading events...
Malware Dropper b54fe9e449dc w4m_singapore_01 · 2026-05-11 06:00
18 1 1 100%
Loading events...
Malware Dropper 6cd02510b857 w4m_singapore_01 · 2026-05-11 05:58
18 1 1 100%
Loading events...
Malware Dropper bb873e445888 w4m_singapore_01 · 2026-05-11 05:56
18 1 1 100%
Loading events...
Malware Dropper c8b2c109a793 w4m_singapore_01 · 2026-05-11 05:54
18 1 1 100%
Loading events...
Malware Dropper 9c60f347c9bb w4m_singapore_01 · 2026-05-11 05:53
18 1 1 100%
Loading events...
Malware Dropper 1f054c1c9c74 w4m_singapore_01 · 2026-05-11 05:52
18 1 1 100%
Loading events...
Malware Dropper 0536d81b88eb w4m_singapore_01 · 2026-05-11 05:48
18 1 1 100%
Loading events...
Malware Dropper d1446d16483e w4m_singapore_01 · 2026-05-11 05:47
18 1 1 100%
Loading events...
Malware Dropper 37b7c8b8a7dd w4m_singapore_01 · 2026-05-11 05:45
18 1 1 100%
Loading events...
Malware Dropper 5f6ea57c6127 w4m_singapore_01 · 2026-05-11 05:43
18 1 1 100%
Loading events...
Malware Dropper f4100ef36a9b w4m_singapore_01 · 2026-05-11 05:41
18 1 1 100%
Loading events...
Malware Dropper 07c30b912246 w4m_singapore_01 · 2026-05-11 05:39
18 1 1 100%
Loading events...
Malware Dropper d0e1132a4c82 w4m_singapore_01 · 2026-05-11 05:38
18 1 1 100%
Loading events...
Malware Dropper 0a19ec55d4d7 w4m_singapore_01 · 2026-05-11 05:37
18 1 1 100%
Loading events...
Malware Dropper 0c9161c56c81 w4m_singapore_01 · 2026-05-11 05:35
18 1 1 100%
Loading events...
Malware Dropper 2b27e0771fc8 w4m_singapore_01 · 2026-05-11 05:31
18 1 1 100%
Loading events...
Malware Dropper 2498f16368e5 w4m_singapore_01 · 2026-05-11 05:30
18 1 1 100%
Loading events...
Malware Dropper 4452c0d6b339 w4m_singapore_01 · 2026-05-11 05:29
18 1 1 100%
Loading events...
Malware Dropper 10b47c4294fc w4m_singapore_01 · 2026-05-11 05:27
18 1 1 100%
Loading events...
Malware Dropper 4db03ce5e820 w4m_singapore_01 · 2026-05-11 05:25
18 1 1 100%
Loading events...
Credential Probe b797a2cbf5bf w4m_singapore_01 · 2026-05-11 05:23
1 20%
Loading events...
Scanner 17c1f555e5a0 w4m_seattle_01 · 2026-02-25 17:38
15%
Loading events...
Reconnaissance 4a959b5a9255 w4m_seattle_01 · 2026-02-25 16:41
1 1 60%
Loading events...
Reconnaissance 9b639c26f26a w4m_seattle_01 · 2026-02-25 15:46
1 1 60%
Loading events...