Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 103.224.166.216Previously Malicious

IP Address: 103.224.166.216Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Download Operation HTTP Successful SSH Login Download and Execute 1 Shell Commands Scheduled Task Creation Outgoing Connection Download and Allow Execution SSH Download File

Associated Attack Servers

a2webhosting.com lampshoponline.com

24.178.152.177 24.210.195.51 35.129.117.11 35.133.63.168 35.134.81.10 47.25.97.173 47.26.25.30 58.6.217.122 64.67.156.149 66.215.237.121 68.66.253.100 68.114.64.220 68.116.148.98 69.20.141.117 70.115.64.38 71.80.168.89 72.80.255.59 74.196.126.131 75.84.87.108 75.137.147.45 76.87.16.224 80.42.198.141 86.152.45.59 92.3.114.39 97.85.221.142 97.88.198.253 104.152.59.244 107.5.163.129 108.178.107.140

Basic Information

IP Address

103.224.166.216

Domain

-

ISP

MyRepublic

Country

Singapore

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2018-02-18

Last seen in Akamai Guardicore Segmentation

2021-06-14

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List

Successful SSH Login

A possibly malicious Download Operation was detected 2 times

Download Operation

Process /bin/bash generated outgoing network traffic to: 71.127.148.69:80

Outgoing Connection

Process /usr/bin/wget generated outgoing network traffic to: 71.127.148.69:80 4 times

Outgoing Connection

Process /usr/local/bin/dash generated outgoing network traffic to: 71.127.148.69:80

Outgoing Connection

Process /usr/local/bin/dash generated outgoing network traffic to: 71.127.148.69:80 2 times

Outgoing Connection

Process /usr/local/bin/dash generated outgoing network traffic to: 71.127.148.69:80 4 times

Outgoing Connection

The file /root/pty was downloaded and executed 19 times

Download and Execute

Process /usr/bin/wget generated outgoing network traffic to: 71.127.148.69:80 2 times

Outgoing Connection

The file /root/irq0 was downloaded and granted execution privileges

Download and Allow Execution

The file /root/irq1 was downloaded and granted execution privileges

Download and Allow Execution

The file /var/tmp/pty was downloaded and executed

Download and Execute

Connection was closed due to user inactivity

Associated Files

/tmp/pty2

SHA256: 269bd261e69199215424b02684874a53e151b920d88c2636b098c8d80e331441

56256 bytes

/tmp/pty1

SHA256: 6a25f8abb828e818d6f0dab6e1e6cf32de7793ec7d88e495062cf92a8998410e

56644 bytes

/tmp/pty10

SHA256: cca57312b18d0e19a02ef5637231afcdb6038fb62ba5d71d31201fdcb5c0a4bd

13215 bytes