IP Address: 52.80.216.240Previously Malicious
IP Address: 52.80.216.240Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
Role |
Attacker, Scanner |
Services Targeted |
SSH |
Tags |
New SSH Key SSH Outgoing Connection Access Suspicious Domain Successful SSH Login Download and Execute |
Associated Attack Servers |
ident.me terasys.co.id usib.tv 23.46.239.19 31.220.41.202 34.205.208.47 39.104.166.233 47.56.225.121 47.56.231.112 47.104.31.129 47.105.56.99 47.244.107.80 49.73.84.142 49.233.24.52 49.233.54.23 49.235.92.174 49.235.238.86 58.144.209.82 61.147.70.96 66.171.248.178 103.29.119.125 103.40.48.219 103.133.20.28 106.52.48.147 106.52.96.133 106.53.9.163 107.170.192.159 111.229.15.130 111.231.255.200 116.202.55.106 117.73.10.53 118.25.91.121 |
IP Address |
52.80.216.240 |
|
Domain |
- |
|
ISP |
Beijing Guanghuan Xinwang Digital Technology co.Lt |
|
Country |
China |
|
WHOIS |
Created Date |
- |
Updated Date |
- |
|
Organization |
- |
First seen in Akamai Guardicore Segmentation |
2020-08-23 |
Last seen in Akamai Guardicore Segmentation |
2020-08-30 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List |
Successful SSH Login |
The file /usr/bin/dlhwyt was downloaded and executed 40 times |
Download and Execute |
Process /usr/bin/dlhwyt generated outgoing network traffic to: 1.1.1.1:53, 103.133.20.28:34802, 103.29.119.125:22969, 103.40.48.219:41834, 106.52.48.147:38247, 106.52.96.133:39255, 106.53.9.163:41557, 107.170.192.159:8000, 111.229.15.130:54793, 111.231.255.200:41137, 116.202.55.106:80, 117.73.10.53:36467, 118.25.91.121:36865, 119.39.254.177:35127, 120.77.57.124:39223, 122.51.116.192:33673, 122.51.121.81:33391, 122.51.68.129:42647, 122.51.93.183:43543, 122.51.97.231:40054, 129.226.60.190:34870, 129.28.193.154:37290, 154.220.2.63:19138, 170.106.14.226:35699, 175.24.116.161:37796, 176.58.123.25:80, 178.78.201.2:50379, 180.124.125.146:51734, 183.234.189.241:51512, 193.22.152.97:41006, 208.67.222.222:443, 211.110.1.206:42809, 211.159.218.146:36289, 212.64.34.108:44629, 216.239.32.21:80, 216.239.36.21:80, 218.248.40.228:52938, 23.46.239.19:80, 31.220.41.202:33133, 34.205.208.47:80, 39.104.166.233:46000, 47.104.31.129:45149, 47.105.56.99:36063, 47.244.107.80:34936, 47.56.225.121:45959, 47.56.231.112:37827, 49.233.24.52:40904, 49.233.54.23:37763, 49.235.238.86:34078, 49.235.92.174:32769, 49.73.84.142:53587, 58.144.209.82:43665, 61.147.70.96:15235 and 66.171.248.178:80 |
Outgoing Connection |
Process /usr/bin/dlhwyt attempted to access suspicious domains: icanhazip.com, ident.me, one.one, terasys.co.id and usib.tv |
Access Suspicious Domain Outgoing Connection |
Connection was closed due to timeout |
|
An attempt to download /root/.ssh/authorized_keys was made 25 times |
New SSH Key |