IntrusionLabs IntrusionLabs
← Back to feed

62.171.135.172

vmi3395397.contaboserver.net (contaboserver.net) ✓ FCrDNS
Threat Confidence
23%
Assessment
  • Ran 24 commands on the host.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇩🇪 DE / Frankfurt am Main
ASN
AS51167 · Contabo GmbH
Cloud Provider
—
Total Events
48
Above average by volume
Agent Count
1
First / Last Seen
2026-09-26 05:41 — 2026-09-28 22:43
Attack Types
ssh:bruteforce ssh:intrusion telnet:bruteforce telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1003.008 T1110 T1110.001
Discovery
T1083
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
credential_probe ×3 interactive_operator ×1
Sessions
4 (1 with login)
Avg Depth Score
0.38
Commands Executed
24
Files Downloaded
0
Notable Commands
  • id
  • cat /etc/passwd
  • echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
  • enable
  • system
  • system
  • shell
  • shell
  • sh
  • bash
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
19532158b559096b89b1a5f7d17175b2
SSH Client
SSH-2.0-libssh2_1.11.1
Evidence Timeline
Interactive Operator 7f358ad7e9a2 w4m_seattle_01 · 2026-09-28 22:42
24 1 90%
Loading events...
Credential Probe d69f946fdef5 w4m_seattle_01 · 2026-09-28 22:42
1 20%
Loading events...
Credential Probe 8dce2440a795 w4m_seattle_01 · 2026-09-28 22:42
1 20%
Loading events...
Credential Probe 2c3b5c185d41 w4m_seattle_01 · 2026-09-26 05:41
1 20%
Loading events...