IntrusionLabs IntrusionLabs
← Back to feed

51.4.104.28

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Threat Confidence
70%
Assessment
SSH password brute-forcer
  • Logged in with 8 different credentials across 14 logins.
  • Downloaded 7 files and ran 21 commands on the host.
  • Active for 9 days, 2026-10-05 to 2026-10-15.
  • Runs the same SSH client fingerprint (HASSH) as 553 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇮🇱 IL / Tel Aviv
ASN
AS8075 · Microsoft Corporation
Cloud Provider
Microsoft Azure
Total Events
236
Above average by volume
Agent Count
3
First / Last Seen
2026-10-05 04:35 — 2026-10-15 01:51
Attack Types
ssh:bruteforce ssh:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
105 IPs 673536 events
2026-10-09 — ongoing · 105 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
188 IPs 628953 events
2026-10-01 — ongoing · 188 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
33 IPs 93033 events
2026-09-30 — ongoing · 33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 750186 events
2026-09-30 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
141 IPs 743972 events
2026-09-27 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 943176 events
2026-09-26 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
73 IPs 276198 events
2026-09-20 — ongoing · 73 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 8710 events
2026-09-14 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
120 IPs 380050 events
2026-09-10 — ongoing · 120 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
118 IPs 378387 events
2026-07-03 — ongoing · 118 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
114 IPs 347270 events
2026-06-29 — ongoing · 114 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
96 IPs 371212 events
2026-06-29 — ongoing · 96 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
67 IPs 85030 events
2026-06-28 — ongoing · 67 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
89 IPs 243665 events
2026-06-26 — ongoing · 89 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
179 IPs 810432 events
2026-06-14 — ongoing · 179 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
179 IPs 811344 events
2026-06-14 — ongoing · 179 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 1038507 events
2026-06-10 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Vultr. Scanning the same …
Multi-Agent Scan SCAN Active medium
258 IPs 916376 events
2026-05-29 — ongoing · 258 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
3 IPs 868 events
2026-05-22 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
125 IPs 415848 events
2026-05-22 — ongoing · 125 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 617389 events
2026-05-22 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 687590 events
2026-05-22 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
8 IPs 4180 events
2026-03-31 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 983317 events
2026-03-21 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
138 IPs 432247 events
2026-03-21 — ongoing · 138 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 727013 events
2026-03-21 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
130 IPs 277405 events
2026-03-18 — ongoing · 130 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
82 IPs 193974 events
2026-03-09 — ongoing · 82 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
86 IPs 232890 events
2026-03-08 — ongoing · 86 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
86 IPs 520915 events
2026-03-03 — ongoing · 86 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
144 IPs 827944 events
2026-03-03 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
150 IPs 780709 events
2026-03-03 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
16 IPs 17014 events
2026-03-03 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 741974 events
2026-03-02 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 928166 events
2026-03-01 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
23 IPs 135532 events
2026-02-26 — ongoing · 23 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
225 IPs 891880 events
2026-02-26 — ongoing · 225 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (554 IPs, 70 countries) HASSH Active high 🇺🇸 US
554 IPs 825577 events
smtp:relayssh:bruteforcessh:connectionssh:intrusionssh:malwaressh:proxy-abuse
2026-02-25 — ongoing · 554 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Microsoft Corporation (AS8075). Geographic and …
Session Forensics
malware_dropper ×7 credential_probe ×22 opportunistic_bruter ×7
Sessions
36 (14 with login)
Avg Depth Score
0.41
Commands Executed
21
Files Downloaded
7
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Opportunistic Bruter 0aca67434654 newark_01 · 2026-10-15 01:51
1 50%
Loading events...
Malware Dropper 5802dcde1d13 newark_01 · 2026-10-15 01:51
3 1 1 100%
Loading events...
Credential Probe 606d981615f7 newark_01 · 2026-10-15 01:51
1 20%
Loading events...
Malware Dropper bffbb3b35cae w4m_seattle_01 · 2026-10-11 23:49
3 1 1 100%
Loading events...
Opportunistic Bruter 9b4f2d12d58b w4m_seattle_01 · 2026-10-11 23:49
1 50%
Loading events...
Credential Probe 73b4ad259c4f w4m_seattle_01 · 2026-10-11 23:49
1 20%
Loading events...
Credential Probe 93c5032fc39a w4m_singapore_01 · 2026-10-05 05:09
1 20%
Loading events...
Credential Probe 193bee555f94 w4m_singapore_01 · 2026-10-05 05:07
1 20%
Loading events...
Credential Probe ecf87255722b w4m_singapore_01 · 2026-10-05 05:05
1 20%
Loading events...
Credential Probe bb65091a9475 w4m_singapore_01 · 2026-10-05 05:04
1 20%
Loading events...
Credential Probe 9f0e532a8bd1 w4m_singapore_01 · 2026-10-05 05:02
1 20%
Loading events...
Opportunistic Bruter 94f52c5b575c w4m_singapore_01 · 2026-10-05 05:00
1 50%
Loading events...
Malware Dropper e8a244d2c6a9 w4m_singapore_01 · 2026-10-05 05:00
3 1 1 100%
Loading events...
Credential Probe 0ecf47d42e68 w4m_singapore_01 · 2026-10-05 05:00
1 20%
Loading events...
Credential Probe 9e6072091e2a w4m_singapore_01 · 2026-10-05 04:58
1 20%
Loading events...
Credential Probe 86f27d6e88f7 w4m_singapore_01 · 2026-10-05 04:57
1 20%
Loading events...
Opportunistic Bruter 0a1c3f7234cc w4m_singapore_01 · 2026-10-05 04:55
1 50%
Loading events...
Malware Dropper 4f6f6b3718df w4m_singapore_01 · 2026-10-05 04:55
3 1 1 100%
Loading events...
Credential Probe e425498257d8 w4m_singapore_01 · 2026-10-05 04:55
1 20%
Loading events...
Credential Probe 98c35484e33f w4m_singapore_01 · 2026-10-05 04:53
1 20%
Loading events...
Opportunistic Bruter fee7a92d3ee0 w4m_singapore_01 · 2026-10-05 04:52
1 50%
Loading events...
Malware Dropper 835acc32f876 w4m_singapore_01 · 2026-10-05 04:52
3 1 1 100%
Loading events...
Credential Probe 59b6bbf7f2b2 w4m_singapore_01 · 2026-10-05 04:52
1 20%
Loading events...
Credential Probe 22fb55bc270c w4m_singapore_01 · 2026-10-05 04:50
1 20%
Loading events...
Opportunistic Bruter be009d95811b w4m_singapore_01 · 2026-10-05 04:48
1 50%
Loading events...
Malware Dropper 43e37db42e11 w4m_singapore_01 · 2026-10-05 04:48
3 1 1 100%
Loading events...
Credential Probe 4e5354b5a889 w4m_singapore_01 · 2026-10-05 04:48
1 20%
Loading events...
Credential Probe 6348e094722e w4m_singapore_01 · 2026-10-05 04:46
1 20%
Loading events...
Credential Probe ab2e1df0d915 w4m_singapore_01 · 2026-10-05 04:45
1 20%
Loading events...
Opportunistic Bruter 474bb96934fa w4m_singapore_01 · 2026-10-05 04:43
1 50%
Loading events...
Malware Dropper 9579e0178983 w4m_singapore_01 · 2026-10-05 04:43
3 1 1 100%
Loading events...
Credential Probe b4900db9c58c w4m_singapore_01 · 2026-10-05 04:43
1 20%
Loading events...
Credential Probe 243337b0718a w4m_singapore_01 · 2026-10-05 04:41
1 20%
Loading events...
Credential Probe 77a50ef6eabb w4m_singapore_01 · 2026-10-05 04:40
1 20%
Loading events...
Credential Probe d85550b37cd9 w4m_singapore_01 · 2026-10-05 04:38
1 20%
Loading events...
Credential Probe b8c21759dbc6 w4m_singapore_01 · 2026-10-05 04:35
1 20%
Loading events...