Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 59.24.153.124Previously Malicious

IP Address: 59.24.153.124Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Port 22 Scan Access Suspicious Domain SSH Download and Allow Execution 8 Shell Commands Successful SSH Login Listening Port 2222 Scan Download and Execute Outgoing Connection

Associated Attack Servers

albacom.net

52.175.252.75 100.0.197.18 122.51.48.52 172.105.92.28 218.146.128.93

Basic Information

IP Address

59.24.153.124

Domain

-

ISP

Korea Telecom

Country

Korea, Republic of

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2020-06-07

Last seen in Akamai Guardicore Segmentation

2020-06-10

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List

Successful SSH Login

A user logged in using SSH with the following credentials: root / **** - Authentication policy: Correct Password 3 times

Successful SSH Login

The file /tmp/ifconfig was downloaded and executed 7 times

Download and Execute

The file /tmp/nginx was downloaded and executed 114 times

Download and Execute

Process /tmp/nginx scanned port 22 on 46 IP Addresses

Port 22 Scan Port 2222 Scan

Process /tmp/nginx scanned port 2222 on 46 IP Addresses

Port 22 Scan Port 2222 Scan

Process /tmp/nginx scanned port 22 on 36 IP Addresses

Port 22 Scan Port 2222 Scan

Process /tmp/nginx started listening on ports: 1234

Listening

Process /tmp/nginx generated outgoing network traffic to: 1.28.109.197:22, 100.0.197.18:1234, 11.39.43.202:22, 11.39.43.202:2222, 117.1.216.175:22, 12.149.59.158:22, 121.155.49.93:1234, 122.51.48.52:1234, 125.46.122.109:22, 126.20.30.94:22, 129.82.190.180:2222, 140.63.175.156:22, 140.63.175.156:2222, 143.118.82.99:22, 149.52.223.78:22, 151.121.150.72:2222, 157.11.114.88:22, 157.11.114.88:2222, 159.210.164.148:22, 169.107.173.113:22, 169.144.117.14:22, 171.14.155.146:2222, 172.105.92.28:1234, 175.46.55.79:22, 175.46.55.79:2222, 178.141.30.11:22, 178.141.30.11:2222, 18.132.189.110:22, 18.132.189.110:2222, 18.20.159.58:22, 18.20.159.58:2222, 188.63.129.140:22, 192.183.38.98:22, 192.183.38.98:2222, 194.103.110.144:22, 196.136.37.236:22, 196.136.37.236:2222, 196.216.39.112:22, 2.183.78.22:2222, 20.82.212.223:22, 20.82.212.223:2222, 200.51.203.115:2222, 205.131.105.71:22, 210.62.86.22:22, 215.1.22.154:22, 215.1.22.154:2222, 215.161.219.34:22, 215.161.219.34:2222, 218.146.128.93:1234, 221.82.176.16:22, 24.203.17.29:22, 241.32.46.170:22, 243.33.102.94:22, 243.33.102.94:2222, 244.53.112.241:22, 244.53.112.241:2222, 248.197.166.245:22, 248.197.166.245:2222, 25.95.143.76:2222, 250.72.78.211:22, 253.194.61.61:2222, 29.10.235.192:22, 31.82.231.163:22, 31.82.231.163:2222, 32.252.226.201:2222, 38.172.124.87:22, 38.172.124.87:2222, 43.111.21.2:22, 43.111.21.2:2222, 50.128.138.36:22, 50.128.138.36:2222, 50.248.18.6:2222, 52.175.252.75:1234, 54.200.95.163:22, 54.200.95.163:2222, 56.143.130.165:2222, 61.131.101.163:2222, 64.141.82.86:22, 64.141.82.86:2222, 65.18.210.199:22, 65.18.210.199:2222, 73.222.94.111:22, 73.222.94.111:2222, 77.162.17.52:22, 77.162.17.52:2222, 78.5.170.222:1234, 82.1.140.188:22 and 82.1.140.188:2222

Outgoing Connection

Process /tmp/nginx attempted to access suspicious domains: albacom.net

Access Suspicious Domain Outgoing Connection

Process /tmp/nginx scanned port 2222 on 36 IP Addresses

Port 22 Scan Port 2222 Scan

The file /usr/bin/uptime was downloaded and executed

Download and Execute

The file /tmp/php-fpm was downloaded and executed 26 times

Download and Execute

The file /tmp/php-fpm was downloaded and executed 7 times

Download and Execute

The file /tmp/php-fpm was downloaded and executed 20 times

Download and Execute

The file /tmp/php-fpm was downloaded and executed 10 times

Download and Execute

Connection was closed due to timeout