IntrusionLabs IntrusionLabs
← Back to feed

45.119.212.145

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
52%
Assessment
SSH password brute-forcer
  • Logged in with 39 different credentials across 76 logins.
  • Downloaded 38 files and ran 114 commands on the host.
  • Active for 11 days, 2026-09-17 to 2026-09-29.
  • Part of a 165-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇻🇳 VN
ASN
AS131423 · Branch of Long Van System Solution JSC - Hanoi
Cloud Provider
—
Total Events
1134
Top 5% by volume
Agent Count
2
First / Last Seen
2026-09-17 14:54 — 2026-09-29 01:40
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
141 IPs 376589 events
2026-09-22 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
141 IPs 362849 events
2026-09-18 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
125 IPs 321774 events
2026-09-14 — ongoing · 125 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
148 IPs 382890 events
2026-09-14 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
77 IPs 72191 events
2026-08-26 — ongoing · 77 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
92 IPs 173574 events
2026-07-01 — ongoing · 92 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
109 IPs 88024 events
2026-06-09 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …
Multi-Agent Scan SCAN Active medium
159 IPs 381203 events
2026-04-15 — ongoing · 159 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 295155 events
2026-03-31 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
119 IPs 403220 events
2026-03-22 — ongoing · 119 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 366319 events
2026-03-22 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
123 IPs 353795 events
2026-03-22 — ongoing · 123 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 442748 events
2026-03-22 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
123 IPs 305622 events
2026-03-14 — ongoing · 123 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
115 IPs 314249 events
2026-03-10 — ongoing · 115 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
144 IPs 327071 events
2026-03-08 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 414591 events
2026-03-05 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
124 IPs 68687 events
2026-03-05 — ongoing · 124 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
144 IPs 359237 events
2026-03-05 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 415775 events
2026-03-05 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 435063 events
2026-03-05 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
125 IPs 363673 events
2026-03-05 — ongoing · 125 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
95 IPs 81074 events
2026-03-05 — ongoing · 95 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
107 IPs 81000 events
2026-03-05 — ongoing · 107 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
111 IPs 332710 events
2026-03-05 — ongoing · 111 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
90 IPs 289280 events
2026-03-03 — ongoing · 90 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
146 IPs 387736 events
2026-03-02 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 335748 events
2026-03-01 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
AS131423 Branch of Long Van System Solution JSC - Hanoi ASN Active medium 🇻🇳 VN
5 IPs 8569 events
ssh:bruteforcessh:connectionssh:intrusionssh:malware
2026-02-28 — ongoing · 5 IPs from the same network (Branch of Long Van System Solution JSC - Hanoi, AS131423) were active …
Multi-Agent Scan SCAN Active medium
2 IPs 926 events
2026-02-26 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 329206 events
2026-02-24 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
156 IPs 400815 events
2026-02-24 — ongoing · 156 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×38 credential_probe ×90 opportunistic_bruter ×38
Sessions
166 (76 with login)
Avg Depth Score
0.45
Commands Executed
114
Files Downloaded
38
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Opportunistic Bruter 797f7589cf09 w4m_singapore_01 · 2026-09-29 01:40
1 50%
Loading events...
Malware Dropper 2db33d5e7e5d w4m_singapore_01 · 2026-09-29 01:40
3 1 1 100%
Loading events...
Credential Probe fb6a6186db5c w4m_singapore_01 · 2026-09-29 01:40
1 20%
Loading events...
Opportunistic Bruter 1bee54def8ab w4m_singapore_01 · 2026-09-29 01:39
1 50%
Loading events...
Malware Dropper 554175be2e59 w4m_singapore_01 · 2026-09-29 01:39
3 1 1 100%
Loading events...
Credential Probe 1e98bd77ad04 w4m_singapore_01 · 2026-09-29 01:39
1 20%
Loading events...
Credential Probe a5ffc8aeb2de w4m_singapore_01 · 2026-09-29 01:38
1 20%
Loading events...
Opportunistic Bruter 6061a9dd6e4d w4m_singapore_01 · 2026-09-29 01:37
1 50%
Loading events...
Malware Dropper 33d1790f9cee w4m_singapore_01 · 2026-09-29 01:37
3 1 1 100%
Loading events...
Credential Probe e29bc8e39e30 w4m_singapore_01 · 2026-09-29 01:37
1 20%
Loading events...
Opportunistic Bruter e9cb08fe3328 w4m_singapore_01 · 2026-09-29 01:36
1 50%
Loading events...
Malware Dropper 49afb9f5fe6c w4m_singapore_01 · 2026-09-29 01:36
3 1 1 100%
Loading events...
Credential Probe 02e703d86d8d w4m_singapore_01 · 2026-09-29 01:36
1 20%
Loading events...
Opportunistic Bruter 8e3cdc0a3420 w4m_singapore_01 · 2026-09-29 01:35
1 50%
Loading events...
Malware Dropper 798155dcf3a2 w4m_singapore_01 · 2026-09-29 01:35
3 1 1 100%
Loading events...
Credential Probe 2ab3e34f504e w4m_singapore_01 · 2026-09-29 01:35
1 20%
Loading events...
Opportunistic Bruter 130530a0238b w4m_singapore_01 · 2026-09-29 01:34
1 50%
Loading events...
Malware Dropper 42d85db6802c w4m_singapore_01 · 2026-09-29 01:34
3 1 1 100%
Loading events...
Credential Probe 5442763977c2 w4m_singapore_01 · 2026-09-29 01:34
1 20%
Loading events...
Credential Probe a39cdba61997 w4m_singapore_01 · 2026-09-29 01:33
1 20%
Loading events...
Opportunistic Bruter f5e34f97feb8 w4m_singapore_01 · 2026-09-29 01:32
1 50%
Loading events...
Malware Dropper f85eaca535df w4m_singapore_01 · 2026-09-29 01:32
3 1 1 100%
Loading events...
Credential Probe 42e60b797456 w4m_singapore_01 · 2026-09-29 01:32
1 20%
Loading events...
Credential Probe 69dc1359d54f w4m_singapore_01 · 2026-09-29 01:31
1 20%
Loading events...
Opportunistic Bruter e13defc48e86 w4m_singapore_01 · 2026-09-29 01:30
1 50%
Loading events...
Malware Dropper 1c488a18d18e w4m_singapore_01 · 2026-09-29 01:30
3 1 1 100%
Loading events...
Credential Probe ece78cd4cd48 w4m_singapore_01 · 2026-09-29 01:30
1 20%
Loading events...
Credential Probe 425d3aacfd4d w4m_singapore_01 · 2026-09-29 01:29
1 20%
Loading events...
Credential Probe a0d67d809fa8 w4m_singapore_01 · 2026-09-29 01:28
1 20%
Loading events...
Opportunistic Bruter a68c7f455917 w4m_singapore_01 · 2026-09-29 01:27
1 50%
Loading events...
Malware Dropper 6c0af61a0bb2 w4m_singapore_01 · 2026-09-29 01:27
3 1 1 100%
Loading events...
Credential Probe 42513ac983e1 w4m_singapore_01 · 2026-09-29 01:27
1 20%
Loading events...
Opportunistic Bruter 87ecdd5fbe46 w4m_singapore_01 · 2026-09-29 01:26
1 50%
Loading events...
Malware Dropper 0e46517fa130 w4m_singapore_01 · 2026-09-29 01:26
3 1 1 100%
Loading events...
Credential Probe e1b6b7b33d8b w4m_singapore_01 · 2026-09-29 01:26
1 20%
Loading events...
Credential Probe 297e047d8a8d w4m_singapore_01 · 2026-09-29 01:25
1 20%
Loading events...
Credential Probe bc55325dd00e w4m_singapore_01 · 2026-09-29 01:24
1 20%
Loading events...
Credential Probe 74ee08836390 w4m_singapore_01 · 2026-09-29 01:23
1 20%
Loading events...
Credential Probe 6efe898fed11 w4m_singapore_01 · 2026-09-29 01:22
1 20%
Loading events...
Credential Probe ae31ebbc78c7 w4m_singapore_01 · 2026-09-29 01:20
1 20%
Loading events...
Credential Probe beb27dd453e2 newark_01 · 2026-09-21 10:23
1 20%
Loading events...
Credential Probe 18aff99e6c18 newark_01 · 2026-09-21 10:21
1 20%
Loading events...
Credential Probe f3544740b3c0 newark_01 · 2026-09-21 10:19
1 20%
Loading events...
Opportunistic Bruter fa7cbacd81cf newark_01 · 2026-09-21 10:18
1 50%
Loading events...
Malware Dropper 583d260a76eb newark_01 · 2026-09-21 10:18
3 1 1 100%
Loading events...
Credential Probe f17e5c872831 newark_01 · 2026-09-21 10:18
1 20%
Loading events...
Malware Dropper 1cf290f7f04b newark_01 · 2026-09-21 10:16
3 1 1 100%
Loading events...
Opportunistic Bruter 551231d3a8b1 newark_01 · 2026-09-21 10:16
1 50%
Loading events...
Credential Probe 47b210ec8d88 newark_01 · 2026-09-21 10:16
1 20%
Loading events...
Credential Probe 50fa87112ce2 newark_01 · 2026-09-21 10:14
1 20%
Loading events...