IP Address: 31.210.20.142Previously Malicious
IP Address: 31.210.20.142Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Connect-Back, Scanner |
Services Targeted |
SSH |
Tags |
Port 22 Scan HTTP Human Download Operation Superuser Operation Outgoing Connection Download File Successful SSH Login Download and Execute DNS Query 18 Shell Commands SSH |
Associated Attack Servers |
46.185.138.188 79.119.154.255 136.144.41.41 144.76.136.153 203.159.80.131 |
IP Address |
31.210.20.142 |
|
Domain |
- |
|
ISP |
Kiobi B.V. |
|
Country |
Netherlands |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2021-06-11 |
Last seen in Akamai Guardicore Segmentation |
2021-09-12 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using SSH with the following credentials: root / ******** - Authentication policy: White List |
Successful SSH Login |
A possibly malicious Download Operation was detected |
Download Operation Superuser Operation |
A possibly malicious Superuser Operation was detected |
Download Operation Superuser Operation |
Process /usr/bin/wget attempted to access domains: transfer.sh |
DNS Query |
Process /usr/bin/wget generated outgoing network traffic to: 144.76.136.153:80 |
Outgoing Connection |
/var/tmp/g.tar was downloaded |
Download File |
A user logged in using SSH with the following credentials: root / ******** - Authentication policy: Correct Password |
Successful SSH Login |
Process /bin/bash generated outgoing network traffic to: 31.210.20.142:80 |
Outgoing Connection |
The file /var/tmp/g/brute was downloaded and executed 7 times |
Download and Execute |
Process /bin/bash generated outgoing network traffic to: 91.211.0.10:22, 91.211.0.11:22, 91.211.0.12:22, 91.211.0.13:22, 91.211.0.14:22, 91.211.0.15:22, 91.211.0.16:22, 91.211.0.17:22, 91.211.0.18:22, 91.211.0.19:22, 91.211.0.1:22, 91.211.0.20:22, 91.211.0.21:22, 91.211.0.22:22, 91.211.0.23:22, 91.211.0.24:22, 91.211.0.25:22, 91.211.0.26:22, 91.211.0.27:22, 91.211.0.28:22, 91.211.0.29:22, 91.211.0.2:22, 91.211.0.30:22, 91.211.0.31:22, 91.211.0.32:22, 91.211.0.33:22, 91.211.0.34:22, 91.211.0.35:22, 91.211.0.36:22, 91.211.0.37:22, 91.211.0.38:22, 91.211.0.39:22, 91.211.0.3:22, 91.211.0.40:22, 91.211.0.41:22, 91.211.0.42:22, 91.211.0.43:22, 91.211.0.44:22, 91.211.0.45:22, 91.211.0.46:22, 91.211.0.47:22, 91.211.0.48:22, 91.211.0.49:22, 91.211.0.4:22, 91.211.0.50:22, 91.211.0.51:22, 91.211.0.52:22, 91.211.0.53:22, 91.211.0.54:22, 91.211.0.55:22, 91.211.0.56:22, 91.211.0.57:22, 91.211.0.58:22, 91.211.0.59:22, 91.211.0.5:22, 91.211.0.60:22, 91.211.0.61:22, 91.211.0.62:22, 91.211.0.63:22, 91.211.0.64:22, 91.211.0.65:22, 91.211.0.66:22, 91.211.0.67:22, 91.211.0.68:22, 91.211.0.69:22, 91.211.0.6:22, 91.211.0.70:22, 91.211.0.71:22, 91.211.0.72:22, 91.211.0.73:22, 91.211.0.74:22, 91.211.0.75:22, 91.211.0.76:22, 91.211.0.77:22, 91.211.0.78:22, 91.211.0.79:22, 91.211.0.7:22, 91.211.0.80:22, 91.211.0.81:22, 91.211.0.82:22, 91.211.0.83:22, 91.211.0.84:22, 91.211.0.85:22, 91.211.0.86:22, 91.211.0.87:22, 91.211.0.88:22, 91.211.0.89:22, 91.211.0.8:22, 91.211.0.90:22, 91.211.0.91:22, 91.211.0.92:22, 91.211.0.93:22, 91.211.0.94:22, 91.211.0.95:22, 91.211.0.96:22, 91.211.0.97:22, 91.211.0.98:22 and 91.211.0.9:22 |
|
Process /bin/bash scanned port 22 on 98 IP Addresses |
Port 22 Scan |
The file /var/tmp/g/ps was downloaded and executed 3 times |
Download and Execute |
Connection was closed due to timeout |
|