IP Address: 79.119.154.255Previously Malicious
IP Address: 79.119.154.255Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SSH |
|
Tags |
Service Stop Port 22 Scan HTTP Human Download Operation Superuser Operation System File Modification Networking Operation 60 Shell Commands Outgoing Connection Download File Successful SSH Login Download and Execute DNS Query SSH |
|
Associated Attack Servers |
|
IP Address |
79.119.154.255 |
|
|
Domain |
- |
|
|
ISP |
RCS & RDS |
|
|
Country |
Romania |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2021-09-12 |
|
Last seen in Akamai Guardicore Segmentation |
2021-09-19 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / ******** - Authentication policy: White List |
Successful SSH Login |
|
A possibly malicious Download Operation was detected 4 times |
Download Operation Networking Operation Superuser Operation |
|
Process /bin/bash attempted to access domains: google.com and www.google.com |
DNS Query |
|
Process /bin/bash generated outgoing network traffic to: 142.251.32.4:80 and 172.217.5.14:80 |
|
|
/root/index.html was downloaded |
Download File |
|
A possibly malicious Superuser Operation was detected |
Download Operation Networking Operation Superuser Operation |
|
System file /etc/shadow was modified 9 times |
System File Modification |
|
Process /usr/bin/wget attempted to access domains: transfer.sh 2 times |
DNS Query |
|
Process /usr/bin/wget generated outgoing network traffic to: 144.76.136.153:80 2 times |
Outgoing Connection |
|
/var/tmp/g.tar was downloaded |
Download File |
|
A possibly malicious Networking Operation was detected |
Download Operation Networking Operation Superuser Operation |
|
Service ipchains was stopped 2 times |
Service Stop |
|
Service iptables was stopped 7 times |
Service Stop |
|
A possibly malicious Download Operation was detected |
Download Operation Networking Operation Superuser Operation |
|
/tmp/g.tar was downloaded |
Download File |
|
A user logged in using SSH with the following credentials: root / ************* - Authentication policy: Correct Password |
Successful SSH Login |
|
Process /tmp/g/ps generated outgoing network traffic to: 91.121.0.10:22, 91.121.0.11:22, 91.121.0.12:22, 91.121.0.13:22, 91.121.0.14:22, 91.121.0.15:22, 91.121.0.16:22, 91.121.0.17:22, 91.121.0.18:22, 91.121.0.19:22, 91.121.0.1:22, 91.121.0.20:22, 91.121.0.21:22, 91.121.0.22:22, 91.121.0.23:22, 91.121.0.24:22, 91.121.0.25:22, 91.121.0.26:22, 91.121.0.27:22, 91.121.0.28:22, 91.121.0.29:22, 91.121.0.2:22, 91.121.0.30:22, 91.121.0.31:22, 91.121.0.32:22, 91.121.0.33:22, 91.121.0.34:22, 91.121.0.35:22, 91.121.0.36:22, 91.121.0.37:22, 91.121.0.38:22, 91.121.0.39:22, 91.121.0.3:22, 91.121.0.40:22, 91.121.0.41:22, 91.121.0.42:22, 91.121.0.43:22, 91.121.0.44:22, 91.121.0.45:22, 91.121.0.46:22, 91.121.0.47:22, 91.121.0.48:22, 91.121.0.49:22, 91.121.0.4:22, 91.121.0.50:22, 91.121.0.51:22, 91.121.0.52:22, 91.121.0.53:22, 91.121.0.54:22, 91.121.0.55:22, 91.121.0.56:22, 91.121.0.57:22, 91.121.0.58:22, 91.121.0.59:22, 91.121.0.5:22, 91.121.0.60:22, 91.121.0.61:22, 91.121.0.62:22, 91.121.0.63:22, 91.121.0.64:22, 91.121.0.65:22, 91.121.0.66:22, 91.121.0.67:22, 91.121.0.68:22, 91.121.0.69:22, 91.121.0.6:22, 91.121.0.70:22, 91.121.0.71:22, 91.121.0.72:22, 91.121.0.73:22, 91.121.0.74:22, 91.121.0.75:22, 91.121.0.76:22, 91.121.0.77:22, 91.121.0.78:22, 91.121.0.79:22, 91.121.0.7:22, 91.121.0.80:22, 91.121.0.81:22, 91.121.0.82:22, 91.121.0.83:22, 91.121.0.84:22, 91.121.0.85:22, 91.121.0.86:22, 91.121.0.87:22, 91.121.0.88:22, 91.121.0.89:22, 91.121.0.8:22, 91.121.0.90:22, 91.121.0.91:22, 91.121.0.92:22, 91.121.0.93:22, 91.121.0.94:22, 91.121.0.95:22, 91.121.0.96:22 and 91.121.0.9:22 |
|
|
Process /tmp/g/ps scanned port 22 on 96 IP Addresses |
Port 22 Scan |
|
The file /tmp/g/ps was downloaded and executed |
Download and Execute |
|
Connection was closed due to timeout |
|
© 2023 Akamai Technologies