Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 3.127.255.82Previously Malicious

IP Address: 3.127.255.82Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Connect-Back, Scanner

Services Targeted

SSH

Tags

Port 2222 Scan 15 Shell Commands SSH Listening Port 22 Scan Successful SSH Login Download and Allow Execution Download and Execute

Associated Attack Servers

-

Basic Information

IP Address

3.127.255.82

Domain

-

ISP

Amazon.com

Country

Germany

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2020-08-03

Last seen in Akamai Guardicore Segmentation

2020-08-20

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List

Successful SSH Login

A user logged in using SSH with the following credentials: root / **** - Authentication policy: Correct Password 2 times

Successful SSH Login

The file /root/ifconfig was downloaded and executed 7 times

Download and Execute

The file /root/nginx was downloaded and executed 121 times

Download and Execute

Process /root/ifconfig scanned port 22 on 45 IP Addresses

Port 22 Scan Port 2222 Scan

Process /root/ifconfig scanned port 22 on 47 IP Addresses

Port 22 Scan Port 2222 Scan

Process /root/ifconfig scanned port 2222 on 45 IP Addresses

Port 22 Scan Port 2222 Scan

Process /root/ifconfig started listening on ports: 1234

Listening

Process /root/ifconfig generated outgoing network traffic to: 104.110.99.145:2222, 104.74.133.1:22, 104.74.133.1:2222, 107.92.3.93:22, 107.92.3.93:2222, 11.126.237.113:22, 11.126.237.113:2222, 110.32.110.33:22, 110.32.110.33:2222, 111.84.129.92:22, 111.84.129.92:2222, 117.171.165.155:2222, 117.180.168.90:2222, 125.177.158.139:22, 13.150.87.191:22, 13.150.87.191:2222, 131.8.139.49:22, 131.8.139.49:2222, 134.13.119.91:22, 136.215.88.24:2222, 142.17.241.4:2222, 145.211.150.159:22, 145.211.150.159:2222, 152.249.178.21:22, 152.249.178.21:2222, 161.137.142.90:2222, 161.177.162.26:22, 161.177.162.26:2222, 162.145.39.228:2222, 171.203.36.37:2222, 173.137.162.89:2222, 173.59.115.217:22, 175.136.123.199:22, 175.136.123.199:2222, 176.198.87.164:22, 176.198.87.164:2222, 182.112.146.122:22, 182.112.146.122:2222, 191.159.101.108:22, 191.159.101.108:2222, 194.153.186.244:22, 194.153.186.244:2222, 195.178.136.228:22, 195.178.136.228:2222, 198.125.192.147:2222, 200.101.55.181:22, 201.110.167.12:22, 201.110.167.12:2222, 201.229.124.148:2222, 204.6.252.176:22, 204.6.252.176:2222, 204.95.250.179:2222, 206.232.228.10:22, 21.63.223.55:2222, 22.217.177.192:22, 22.217.177.192:2222, 220.168.241.173:22, 220.168.241.173:2222, 221.222.21.197:22, 223.235.179.57:22, 223.235.179.57:2222, 223.69.24.173:22, 223.69.24.173:2222, 242.199.149.100:22, 242.199.149.100:2222, 245.11.86.229:22, 246.183.143.157:22, 246.88.231.33:22, 251.210.174.190:22, 252.68.228.74:2222, 27.200.43.29:22, 27.200.43.29:2222, 38.38.214.7:22, 38.38.214.7:2222, 50.67.235.10:22, 50.67.235.10:2222, 59.214.206.175:22, 59.214.206.175:2222, 70.26.218.185:22, 70.26.218.185:2222, 71.78.196.99:2222, 74.235.235.50:22, 74.235.235.50:2222, 76.130.200.213:22, 76.130.200.213:2222, 76.177.24.77:22, 83.151.41.175:22, 89.171.122.161:22, 93.237.242.16:2222, 96.147.194.158:22 and 96.147.194.158:2222

Process /root/ifconfig scanned port 2222 on 47 IP Addresses

Port 22 Scan Port 2222 Scan

Connection was closed due to timeout