IP Address: 192.241.142.107Previously Malicious
IP Address: 192.241.142.107Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SSH |
|
Tags |
Access Suspicious Domain SSH New SSH Key Successful SSH Login Executable File Modification Download and Execute Outgoing Connection |
|
Associated Attack Servers |
23.55.220.56 34.192.250.175 39.106.48.41 39.106.143.119 47.52.92.175 47.89.15.233 47.93.14.153 47.93.226.60 47.95.196.235 47.100.126.135 47.101.59.60 47.107.59.45 47.107.73.38 47.112.226.194 47.240.81.89 47.244.8.87 47.244.163.224 49.232.28.144 49.232.132.91 60.248.152.189 66.171.248.178 68.183.186.25 101.201.208.164 103.27.42.38 103.27.42.59 103.27.42.84 103.43.153.220 103.71.76.45 104.171.164.198 106.52.93.52 |
|
IP Address |
192.241.142.107 |
|
|
Domain |
- |
|
|
ISP |
Digital Ocean |
|
|
Country |
United States |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2019-09-05 |
|
Last seen in Akamai Guardicore Segmentation |
2020-06-14 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Reached Max Attempts |
Successful SSH Login |
|
Executable file /usr/bin/kiheox was modified 9 times |
Executable File Modification |
|
The file /usr/bin/kiheox was downloaded and executed 40 times |
Download and Execute |
|
Process /usr/bin/kiheox generated outgoing network traffic to: 1.1.1.1:53, 101.201.208.164:46531, 103.27.42.38:41608, 103.27.42.59:45355, 103.27.42.84:60584, 103.43.153.220:36853, 103.71.76.45:32821, 104.171.164.198:43571, 106.52.93.52:45428, 107.173.160.159:43223, 111.229.129.231:35629, 115.68.22.198:42748, 116.202.244.153:80, 119.27.170.197:37950, 119.28.1.135:39121, 119.29.60.208:47095, 119.9.77.75:38201, 120.77.57.50:35523, 123.56.140.42:46271, 134.209.96.222:43083, 140.143.0.125:39637, 149.129.82.110:35021, 176.58.123.25:80, 194.99.23.133:44437, 208.67.222.222:443, 209.216.90.219:39589, 216.239.32.21:80, 216.239.36.21:80, 218.248.40.228:45960, 218.29.54.177:34759, 221.178.97.23:39147, 23.55.220.56:80, 34.192.250.175:80, 39.106.143.119:34756, 39.106.48.41:42096, 47.100.126.135:43588, 47.101.59.60:37330, 47.107.59.45:39640, 47.107.73.38:42174, 47.112.226.194:46012, 47.240.81.89:37001, 47.244.163.224:42725, 47.244.8.87:43070, 47.52.92.175:37718, 47.89.15.233:45556, 47.93.14.153:34520, 47.93.226.60:38497, 47.95.196.235:38473, 49.232.132.91:45259, 49.232.28.144:42465, 60.248.152.189:60199, 66.171.248.178:80 and 68.183.186.25:8000 |
Outgoing Connection |
|
Process /usr/bin/kiheox attempted to access suspicious domains: adsl, hybs-pro.net, icanhazip.com, ident.me, local, one.one and tampabayfiber.com |
Access Suspicious Domain Outgoing Connection |
|
The file /usr/bin/chattr was downloaded and executed |
Download and Execute |
|
Connection was closed due to timeout |
|
|
An attempt to download /root/.ssh/authorized_keys was made 25 times |
New SSH Key |
© 2023 Akamai Technologies