IntrusionLabs IntrusionLabs
← Back to feed

45.140.42.24

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
66%
Assessment
SSH password brute-forcer
  • Logged in with 23 different credentials across 41 logins.
  • Downloaded 20 files and ran 63 commands on the host.
  • Active for 11 days, 2026-09-25 to 2026-10-06.
  • Part of a 251-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇩🇪 DE / Frankfurt am Main
ASN
AS62240 · Clouvider Limited
Cloud Provider
—
Total Events
582
Top 10% by volume
Agent Count
3
First / Last Seen
2026-09-25 17:48 — 2026-10-06 20:03
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
207 IPs 672905 events
2026-10-04 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
171 IPs 675999 events
2026-09-24 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 642473 events
2026-09-24 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
44 IPs 17791 events
2026-09-19 — ongoing · 44 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 634244 events
2026-09-14 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 538929 events
2026-09-09 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
188 IPs 261897 events
2026-08-06 — ongoing · 188 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
162 IPs 548258 events
2026-07-27 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
204 IPs 692675 events
2026-07-02 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 663571 events
2026-07-02 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
189 IPs 513737 events
2026-05-16 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
229 IPs 765863 events
2026-04-13 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
172 IPs 554787 events
2026-04-06 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
120 IPs 214812 events
2026-03-28 — ongoing · 120 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
111 IPs 197935 events
2026-03-26 — ongoing · 111 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
136 IPs 254810 events
2026-03-21 — ongoing · 136 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 759513 events
2026-03-21 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
208 IPs 743726 events
2026-03-21 — ongoing · 208 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
2 IPs 537 events
2026-03-09 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 723570 events
2026-03-08 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 269314 events
2026-03-08 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 85422 events
2026-03-08 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 258680 events
2026-03-08 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
168 IPs 514477 events
2026-03-08 — ongoing · 168 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
172 IPs 573186 events
2026-03-08 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
10 IPs 30070 events
2026-03-08 — ongoing · 10 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
81 IPs 111260 events
2026-03-08 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
97 IPs 144397 events
2026-03-08 — ongoing · 97 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
251 IPs 718410 events
2026-03-08 — ongoing · 251 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
198 IPs 277835 events
2026-03-08 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 513471 events
2026-03-08 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
116 IPs 516338 events
2026-03-04 — ongoing · 116 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 498842 events
2026-03-03 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 710016 events
2026-03-03 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
115 IPs 236296 events
2026-03-01 — ongoing · 115 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 668493 events
2026-03-01 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 530905 events
2026-03-01 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
217 IPs 705595 events
2026-03-01 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 544529 events
2026-02-28 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
236 IPs 719808 events
2026-02-27 — ongoing · 236 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 reconnaissance ×1 malware_dropper ×20 credential_probe ×41 opportunistic_bruter ×20
Sessions
83 (41 with login)
Avg Depth Score
0.47
Commands Executed
63
Files Downloaded
20
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe ca85aef420a1 newark_01 · 2026-10-06 20:02
1 20%
Loading events...
Credential Probe 0e489b6972bb newark_01 · 2026-10-06 20:01
1 20%
Loading events...
Malware Dropper c3917119c933 newark_01 · 2026-10-06 20:00
3 1 1 100%
Loading events...
Opportunistic Bruter ff810eb17aca newark_01 · 2026-10-06 20:00
1 50%
Loading events...
Credential Probe c1fdd6995323 newark_01 · 2026-10-06 20:00
1 20%
Loading events...
Credential Probe 1ccef9dc2727 newark_01 · 2026-10-06 19:59
1 20%
Loading events...
Opportunistic Bruter e9036494d191 newark_01 · 2026-10-06 19:58
1 50%
Loading events...
Malware Dropper 3a87d026057f newark_01 · 2026-10-06 19:58
3 1 1 100%
Loading events...
Credential Probe 711bd8a8727d newark_01 · 2026-10-06 19:58
1 20%
Loading events...
Credential Probe 038e4ccbbaa8 newark_01 · 2026-10-06 19:56
1 20%
Loading events...
Credential Probe ca91eb10d355 newark_01 · 2026-10-06 19:55
1 20%
Loading events...
Credential Probe 7aca70d6d8a3 newark_01 · 2026-10-06 19:54
1 20%
Loading events...
Credential Probe 62227c3af354 newark_01 · 2026-10-06 19:53
1 20%
Loading events...
Malware Dropper c4e2e99c4a60 newark_01 · 2026-10-06 19:52
3 1 1 100%
Loading events...
Opportunistic Bruter 2f7f80b15c88 newark_01 · 2026-10-06 19:52
1 50%
Loading events...
Credential Probe 7eee706d3551 newark_01 · 2026-10-06 19:52
1 20%
Loading events...
Opportunistic Bruter 66a009e0abfc newark_01 · 2026-10-06 19:51
1 50%
Loading events...
Malware Dropper 7e9df83fa0cc newark_01 · 2026-10-06 19:50
3 1 1 100%
Loading events...
Credential Probe 65722bf17c44 newark_01 · 2026-10-06 19:51
1 20%
Loading events...
Opportunistic Bruter 7eb41e698e3f newark_01 · 2026-10-06 19:49
1 50%
Loading events...
Malware Dropper f16af872814b newark_01 · 2026-10-06 19:49
3 1 1 100%
Loading events...
Credential Probe 25f7dfd003d0 newark_01 · 2026-10-06 19:49
1 20%
Loading events...
Malware Dropper 6bd6482ae40c newark_01 · 2026-10-06 19:48
3 1 1 100%
Loading events...
Opportunistic Bruter 4e539c42bb60 newark_01 · 2026-10-06 19:48
1 50%
Loading events...
Credential Probe b8df133da94f newark_01 · 2026-10-06 19:48
1 20%
Loading events...
Credential Probe 45e9cc26cf1f newark_01 · 2026-10-06 19:47
1 20%
Loading events...
Opportunistic Bruter 8004ed9ea2e3 newark_01 · 2026-10-06 19:46
1 50%
Loading events...
Malware Dropper e8d900331455 newark_01 · 2026-10-06 19:46
3 1 1 100%
Loading events...
Credential Probe 4fd7c8303fcf newark_01 · 2026-10-06 19:46
1 20%
Loading events...
Opportunistic Bruter 2aed63ce4b4f newark_01 · 2026-10-06 19:45
1 50%
Loading events...
Malware Dropper 8b5e1f669bff newark_01 · 2026-10-06 19:45
3 1 1 100%
Loading events...
Credential Probe 947922060a6d newark_01 · 2026-10-06 19:45
1 20%
Loading events...
Opportunistic Bruter 8d15e77b0919 newark_01 · 2026-10-06 19:43
1 50%
Loading events...
Credential Probe fdd0760beaeb newark_01 · 2026-10-06 19:43
1 20%
Loading events...
Malware Dropper 9be7b90145c9 newark_01 · 2026-10-06 19:43
3 1 1 100%
Loading events...
Credential Probe 2fcac03c483b newark_01 · 2026-10-06 19:42
1 20%
Loading events...
Credential Probe 2f219e9f4cde newark_01 · 2026-10-06 19:41
1 20%
Loading events...
Credential Probe 07c5ef4812ba newark_01 · 2026-10-06 19:32
1 20%
Loading events...
Credential Probe 8d4e72871586 w4m_singapore_01 · 2026-10-03 15:44
1 20%
Loading events...
Malware Dropper df322b7ae4c6 w4m_singapore_01 · 2026-10-03 15:43
3 1 1 100%
Loading events...
Opportunistic Bruter 9aeabae89a19 w4m_singapore_01 · 2026-10-03 15:43
1 50%
Loading events...
Credential Probe 55dbc758a101 w4m_singapore_01 · 2026-10-03 15:43
1 20%
Loading events...
Credential Probe 0bdee71cc584 w4m_singapore_01 · 2026-10-03 15:42
1 20%
Loading events...
Credential Probe e5588f694407 w4m_singapore_01 · 2026-10-03 15:40
1 20%
Loading events...
Credential Probe 74681bb141db w4m_singapore_01 · 2026-10-03 15:39
1 20%
Loading events...
Malware Dropper b37d17921e25 w4m_singapore_01 · 2026-10-03 15:38
3 1 1 100%
Loading events...
Opportunistic Bruter 8fbb5f7600c2 w4m_singapore_01 · 2026-10-03 15:38
1 50%
Loading events...
Credential Probe f0671d7a377d w4m_singapore_01 · 2026-10-03 15:38
1 20%
Loading events...
Credential Probe 3e5418b72328 w4m_singapore_01 · 2026-10-03 15:37
1 20%
Loading events...
Opportunistic Bruter b3c6812da987 w4m_singapore_01 · 2026-10-03 15:35
1 50%
Loading events...