IP Address: 183.213.26.13Previously Malicious
IP Address: 183.213.26.13Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
IP Address |
183.213.26.13 |
|
Domain |
- |
|
ISP |
China Mobile Guangdong |
|
Country |
China |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2021-01-04 |
Last seen in Akamai Guardicore Segmentation |
2022-10-14 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List |
Successful SSH Login |
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password |
Successful SSH Login |
A possibly malicious Superuser Operation was detected 12 times |
Superuser Operation |
Process /dev/shm/ifconfig generated outgoing network traffic to: 120.236.78.194:1234 |
Outgoing Connection |
Process /dev/shm/ifconfig started listening on ports: 1234, 8083 and 8181 |
Listening |
The file /tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
The file /tmp/apache2 was downloaded and executed 12 times |
Download and Execute |
Process /tmp/ifconfig generated outgoing network traffic to: 185.210.144.122:1234 |
Outgoing Connection |
Process /tmp/ifconfig started listening on ports: 1234, 8080 and 8189 |
Listening |
Process /tmp/ifconfig attempted to access suspicious domains: srasia-great.com |
Access Suspicious Domain Outgoing Connection |
./ifconfig was downloaded |
Download File |
The file /root/ifconfig was downloaded and executed 10 times |
Download and Execute |
The file /root/apache2 was downloaded and executed 25 times |
Download and Execute |
Process /root/ifconfig generated outgoing network traffic to: 117.16.44.111:1234 |
Outgoing Connection |
Process /root/ifconfig started listening on ports: 1234, 8081 and 8186 |
Listening |
The file /var/tmp/ifconfig was downloaded and executed 3 times |
Download and Execute |
The file /var/tmp/apache2 was downloaded and executed 11 times |
Download and Execute |
Process /var/tmp/apache2 generated outgoing network traffic to: 103.90.177.102:1234 |
Outgoing Connection |
Process /var/tmp/apache2 started listening on ports: 1234, 8087 and 8189 |
Listening |
Process /root/ifconfig generated outgoing network traffic to: 39.175.68.100:1234 |
Outgoing Connection |
Process /root/ifconfig started listening on ports: 1234, 8087 and 8181 |
Listening |
System file /etc/apache2 was modified 4 times |
System File Modification |
The file /etc/ifconfig was downloaded and executed 5 times |
Download and Execute |
The file /etc/apache2 was downloaded and executed 14 times |
Download and Execute |
Process /etc/ifconfig generated outgoing network traffic to: 173.18.35.41:1234 |
Outgoing Connection |
Process /etc/ifconfig started listening on ports: 1234, 8085 and 8189 |
Listening |
Process /etc/ifconfig attempted to access suspicious domains: mchsi.com |
Access Suspicious Domain Outgoing Connection |
Connection was closed due to user inactivity |
|
/var/tmp/ifconfig |
SHA256: 003fc3b1c6259d744b011cde32a47e8cb0b00708ebec1465839b9c14279bc70b |
262144 bytes |
/var/tmp/ifconfig |
SHA256: 0714ec5521ae6a3a058ad379f0e65f8d512eda05239e9e72223a79b456e4362f |
1933312 bytes |
/var/tmp/ifconfig |
SHA256: 1a44fca7624fff41bb0115d35ece06c6b145c23503b4e50eddc373c148b94a1d |
720896 bytes |
/var/tmp/ifconfig |
SHA256: 1b40245f21f1cb845b7fdf2428315166a8b1d8d5e1e42cd290cd8e479ed61ad7 |
2129920 bytes |
/var/tmp/ifconfig |
SHA256: 2aacc3f6c14a2bd120ce9f7cab7af1f4d3e207bea33d56f02a14f75613a7930c |
786432 bytes |
/var/tmp/ifconfig |
SHA256: 331f1ead3df8fed58ccf68da781f34b2f228a5c37f3bb245b836a4b49b1cf269 |
557056 bytes |
/var/tmp/ifconfig |
SHA256: 63ce5e408bc30df5efb4e48cb2e893e84b58da0ea31d834ce11db915f0dfaba2 |
32768 bytes |
/root/ifconfig |
SHA256: 6ee5b0eadb32669e495a5d4157119d3a8248235f0b3e21084070fb6bb45ca89e |
950272 bytes |