IntrusionLabs IntrusionLabs
← Back to feed

45.198.224.119

TAGGED SUSPICIOUS how we decide →
Why: Network is on the Spamhaus ASN-DROP list, with 59 events seen by our sensors · certainty: inferred
Threat Confidence
51%
Assessment
Port and service scanner
  • Logged in with 2 different credentials across 4 logins.
  • Ran 20 commands on the host.
  • Part of a 3-IP campaign from the same subnet.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US
ASN
AS215925 · Vpsvault.host Ltd
Cloud Provider
—
Total Events
75
Above average by volume
Agent Count
1
First / Last Seen
2026-10-17 13:46 — 2026-10-17 19:37
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
External Corroboration
Blocklist.de
Reported 2026-10-19 05:01
blocklist_de:reported
Campaigns
Subnet 45.198.224.0/24 SUBNET Active high 🇺🇸 US
3 IPs 106 events
http:scanssh:bruteforcessh:connectionssh:intrusiontelnet:connection
2026-06-15 — 2026-08-06 · 3 IPs from the same /24 subnet (45.198.224.0/24) were observed attacking our sensors within the same time window. …
Session Forensics
scanner ×5 reconnaissance ×2 credential_probe ×3 interactive_operator ×2
Sessions
12 (4 with login)
Avg Depth Score
0.36
Commands Executed
20
Files Downloaded
0
Notable Commands
  • uname -a
  • xyzabc987_no_such_command
  • xyzabc987_no_such_command
  • echo -e '\147\141\171\146\147\164'
  • X_ABC=val987; echo $X_ABC
  • which wget curl 2>/dev/null || command -v wget curl 2>/dev/null
  • command -v wget curl
  • cat /proc/cpuinfo 2>/dev/null | grep -m1 -iE 'model name|Processor|Hardware'
  • cat /proc/meminfo 2>/dev/null | grep -m1 MemTotal
  • hostname
Fingerprints
2 SSH client banners · 2 HASSH fingerprints
HASSH
3335afa7a75e84f8348f05c623c5ecf9b4b8ae3d7241d2c1dc54b4df7e8c19d1
SSH Client
SSH-2.0-libssh2_1.10.0SSH-2.0-libssh_0.9.6
Evidence Timeline
Reconnaissance 2ed637f553f8 w4m_seattle_01 · 2026-10-17 19:37
1 1 60%
Loading events...
Reconnaissance c638af37f1cb w4m_seattle_01 · 2026-10-17 19:37
1 1 60%
Loading events...
Interactive Operator fce0fdd9ddf0 w4m_seattle_01 · 2026-10-17 13:47
9 1 90%
Loading events...
Scanner 23e1c5ccb3bd w4m_seattle_01 · 2026-10-17 13:47
15%
Loading events...
Interactive Operator 3b2d8cb1be4d w4m_seattle_01 · 2026-10-17 13:46
9 1 90%
Loading events...
Scanner d230bd792677 w4m_seattle_01 · 2026-10-17 13:46
15%
Loading events...
Credential Probe 2240913b0fe7 w4m_seattle_01 · 2026-10-17 13:46
1 20%
Loading events...
Scanner a7a8043f4148 w4m_seattle_01 · 2026-10-17 13:46
15%
Loading events...
Credential Probe 51adeb380461 w4m_seattle_01 · 2026-10-17 13:46
1 20%
Loading events...
Scanner b59ad8ed94da w4m_seattle_01 · 2026-10-17 13:46
15%
Loading events...
Credential Probe 919effb84677 w4m_seattle_01 · 2026-10-17 13:46
1 20%
Loading events...
Scanner c7370bc7add1 w4m_seattle_01 · 2026-10-17 13:46
15%
Loading events...