IP Address: 193.8.82.77Previously Malicious
IP Address: 193.8.82.77Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Connect-Back, Scanner |
|
Services Targeted |
SSH |
|
Tags |
Access Suspicious Domain SSH New SSH Key Successful SSH Login Download and Execute Outgoing Connection |
|
Associated Attack Servers |
23.194.217.50 39.98.201.31 39.105.13.218 39.105.175.226 45.63.66.221 47.52.92.175 47.52.202.185 47.75.173.102 47.93.85.225 47.94.101.75 47.95.145.40 47.96.22.160 47.100.30.15 47.100.78.211 47.101.146.220 47.101.209.202 47.102.195.168 47.104.161.36 47.244.163.224 49.233.195.163 49.234.187.186 49.235.89.53 50.19.206.143 60.248.152.189 61.141.235.89 66.171.248.178 68.183.183.187 71.57.39.2 103.27.42.59 103.43.153.220 |
|
IP Address |
193.8.82.77 |
|
|
Domain |
- |
|
|
ISP |
HK Kwaifong Group Limited |
|
|
Country |
Poland |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2020-04-19 |
|
Last seen in Akamai Guardicore Segmentation |
2021-05-14 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / ******** - Authentication policy: Reached Max Attempts |
Successful SSH Login |
|
The file /usr/bin/xkgpmg was downloaded and executed 45 times |
Download and Execute |
|
Process /usr/bin/xkgpmg generated outgoing network traffic to: 1.1.1.1:53, 103.27.42.59:40393, 104.238.133.124:46497, 106.2.4.58:34931, 106.52.179.77:42652, 106.52.52.230:37609, 111.229.81.166:40968, 116.202.55.106:80, 117.73.10.53:42600, 118.25.185.160:33847, 120.24.182.114:36499, 120.25.243.182:16037, 120.25.65.166:58505, 120.26.241.5:45888, 120.55.165.126:54393, 121.42.15.204:46441, 122.51.146.36:46444, 122.51.80.103:41957, 123.194.80.148:46002, 123.57.66.202:39122, 124.234.194.204:42585, 129.211.127.43:35248, 134.209.96.222:37011, 139.9.223.66:39995, 152.136.143.234:35005, 176.58.123.25:80, 192.144.239.253:40651, 193.8.82.77:24231, 202.5.21.4:8000, 204.237.142.122:80, 208.67.222.222:443, 216.239.32.21:80, 216.239.34.21:80, 218.94.106.15:37021, 223.203.98.179:34033, 39.105.13.218:43586, 47.101.146.220:36117, 47.102.195.168:34054, 47.104.161.36:34148, 47.104.161.36:42527, 47.52.202.185:36316, 47.52.202.185:37524, 47.52.92.175:43165, 47.95.145.40:39148, 49.233.195.163:43379, 50.19.206.143:80, 66.171.248.178:80 and 71.57.39.2:36180 |
Outgoing Connection |
|
Process /usr/bin/xkgpmg attempted to access suspicious domains: hwclouds-dns.com, hybs-pro.net, icanhazip.com, kbronet.com.tw and one.one |
Access Suspicious Domain Outgoing Connection |
|
The file /usr/bin/chattr was downloaded and executed |
Download and Execute |
|
Connection was closed due to timeout |
|
|
An attempt to download /root/.ssh/authorized_keys was made 25 times |
New SSH Key |
© 2023 Akamai Technologies