IP Address: 167.99.192.222Previously Malicious
Browse or download a weekly review of our cyber threat intelligence data and gain more insight to help protect your network
IP Address:
167.99.192.222
Previously Malicious
This IP address attempted an attack on a machine protected by Guardicore Centra
Role |
Attacker, Scanner |
Services Targeted |
HTTP |
Tags |
Download and Allow Execution Outgoing Connection IDS - Web Application Attack Access Suspicious Domain Inbound HTTP Request Download and Execute |
Associated Attack Servers |
40.68.37.80 13.82.25.160 52.173.141.16 40.76.78.149 52.174.17.41 52.178.115.28 188.241.73.105 52.173.191.248 13.82.50.132 |
IP Address |
167.99.192.222 |
|
Domain |
- |
|
ISP |
Digital Ocean |
|
Country |
United Kingdom |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Guardicore Centra |
2019-05-26 |
Last seen in Guardicore Centra |
2019-06-02 |
What is Guardicore CentraGuardicore Centra is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Centra generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
Process /usr/bin/wget generated outgoing network traffic to: 188.241.73.105:80 |
Outgoing Connection |
Process /usr/bin/wget attempted to access suspicious domains: famousresource.com |
Access Suspicious Domain Outgoing Connection |
The file /tmp/flexgoddemons2 was downloaded and executed 4 times |
Download and Execute |
IDS detected Web Application Attack : 401TRG Generic Webshell Request - POST with wget in body |
IDS - Web Application Attack |
Connection was closed due to user inactivity |
|
/tmp/flexgoddemons2 |
SHA256: ac51a73c1a773f6377ca90c2a9726f4c1c2f48dfa280af322eff6f1fd9290eba |
35100 bytes |
/tmp/flex |
SHA256: ad6d653c38aab3c8e08d4dd7bca67a720b4a56097485703e2899cb5d69c34b63 |
13218 bytes |
IP Address: 167.99.192.222Previously Malicious