IP Address: 212.44.105.25Previously Malicious
IP Address: 212.44.105.25Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SSH |
|
Tags |
Download and Allow Execution Human Successful SSH Login Superuser Operation Download Operation Scheduled Task Creation 19 Shell Commands Port 22 Scan DNS Query Download and Execute Access Suspicious Domain Download File Outgoing Connection HTTP SSH |
|
Associated Attack Servers |
|
IP Address |
212.44.105.25 |
|
|
Domain |
- |
|
|
ISP |
DHH.si d.o.o. |
|
|
Country |
Slovenia |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2020-10-08 |
|
Last seen in Akamai Guardicore Segmentation |
2020-10-08 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List |
Successful SSH Login |
|
A possibly malicious Download Operation was detected |
Download Operation Superuser Operation |
|
Process /usr/bin/wget attempted to access suspicious domains: romhack.hi2.ro 2 times |
DNS Query Access Suspicious Domain Outgoing Connection |
|
Process /usr/bin/wget generated outgoing network traffic to: 89.42.39.75:80 2 times |
Outgoing Connection |
|
/var/tmp/dp.tgz was downloaded |
Download File |
|
A possibly malicious Superuser Operation was detected |
Download Operation Superuser Operation |
|
The file /var/tmp/.fast/cfg was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /var/tmp/.fast/pid was downloaded and granted execution privileges |
Download and Allow Execution |
|
A possibly malicious Download Operation was detected |
Download Operation Superuser Operation |
|
/var/tmp/v5.tgz was downloaded |
Download File |
|
The file /var/tmp/v5/filtered was downloaded and granted execution privileges 2 times |
Download and Allow Execution |
|
The file /var/tmp/v5/b was downloaded and granted execution privileges 2 times |
Download and Allow Execution |
|
The file /var/tmp/v5/random was downloaded and granted execution privileges 2 times |
|
|
The file /var/tmp/v5/clear was downloaded and granted execution privileges 2 times |
|
|
The file /var/tmp/v5/pass2 was downloaded and granted execution privileges 2 times |
|
|
The file /var/tmp/v5/c was downloaded and granted execution privileges 2 times |
Download and Allow Execution |
|
The file /var/tmp/v5/global was downloaded and granted execution privileges 2 times |
Download and Allow Execution |
|
The file /var/tmp/v5/pass was downloaded and granted execution privileges 2 times |
Download and Allow Execution |
|
The file /var/tmp/v5/d was downloaded and granted execution privileges 2 times |
|
|
The file /var/tmp/v5/gasite.txt was downloaded and granted execution privileges 2 times |
Download and Allow Execution |
|
The file /var/tmp/v5/a was downloaded and granted execution privileges |
|
|
The file /var/tmp/v5/pass4 was downloaded and granted execution privileges |
|
|
The file /var/tmp/v5/pass3 was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /var/tmp/v5/vuln was downloaded and granted execution privileges |
|
|
The file /var/tmp/v5/cola was downloaded and executed |
Download and Execute |
|
Process /bin/bash generated outgoing network traffic to: 211.16.0.10:22, 211.16.0.11:22, 211.16.0.12:22, 211.16.0.13:22, 211.16.0.14:22, 211.16.0.15:22, 211.16.0.16:22, 211.16.0.17:22, 211.16.0.18:22, 211.16.0.19:22, 211.16.0.1:22, 211.16.0.20:22, 211.16.0.21:22, 211.16.0.22:22, 211.16.0.23:22, 211.16.0.24:22, 211.16.0.25:22, 211.16.0.26:22, 211.16.0.27:22, 211.16.0.28:22, 211.16.0.29:22, 211.16.0.2:22, 211.16.0.30:22, 211.16.0.31:22, 211.16.0.32:22, 211.16.0.33:22, 211.16.0.34:22, 211.16.0.35:22, 211.16.0.36:22, 211.16.0.37:22, 211.16.0.38:22, 211.16.0.39:22, 211.16.0.3:22, 211.16.0.40:22, 211.16.0.41:22, 211.16.0.42:22, 211.16.0.43:22, 211.16.0.44:22, 211.16.0.45:22, 211.16.0.46:22, 211.16.0.47:22, 211.16.0.48:22, 211.16.0.49:22, 211.16.0.4:22, 211.16.0.50:22, 211.16.0.51:22, 211.16.0.52:22, 211.16.0.53:22, 211.16.0.54:22, 211.16.0.55:22, 211.16.0.56:22, 211.16.0.57:22, 211.16.0.58:22, 211.16.0.59:22, 211.16.0.5:22, 211.16.0.60:22, 211.16.0.61:22, 211.16.0.62:22, 211.16.0.63:22, 211.16.0.64:22, 211.16.0.65:22, 211.16.0.66:22, 211.16.0.67:22, 211.16.0.68:22, 211.16.0.69:22, 211.16.0.6:22, 211.16.0.70:22, 211.16.0.71:22, 211.16.0.72:22, 211.16.0.73:22, 211.16.0.74:22, 211.16.0.75:22, 211.16.0.76:22, 211.16.0.77:22, 211.16.0.78:22, 211.16.0.79:22, 211.16.0.7:22, 211.16.0.80:22, 211.16.0.81:22, 211.16.0.82:22, 211.16.0.83:22, 211.16.0.84:22, 211.16.0.85:22, 211.16.0.86:22, 211.16.0.87:22, 211.16.0.88:22, 211.16.0.89:22, 211.16.0.8:22, 211.16.0.90:22, 211.16.0.91:22, 211.16.0.92:22, 211.16.0.93:22, 211.16.0.94:22, 211.16.0.95:22, 211.16.0.96:22, 211.16.0.97:22, 211.16.0.98:22 and 211.16.0.9:22 |
|
|
Process /bin/bash scanned port 22 on 98 IP Addresses |
Port 22 Scan |
|
Connection was closed due to user inactivity |
|
© 2023 Akamai Technologies