Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 110.234.193.8Previously Malicious

IP Address: 110.234.193.8Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SCP SSH

Tags

System File Modification Port 1234 Scan SSH Listening 5 Shell Commands Port 80 Scan Port 8080 Scan Superuser Operation Outgoing Connection Successful SSH Login Download and Execute

Associated Attack Servers

172.64.110.32 172.64.111.32

Basic Information

IP Address

110.234.193.8

Domain

-

ISP

Naver Business Platform Asia Pacific Pte.

Country

Singapore

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-09-23

Last seen in Akamai Guardicore Segmentation

2022-09-30

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

System file /etc/ifconfig was modified 4 times

System File Modification

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password

Successful SSH Login

A possibly malicious Superuser Operation was detected 2 times

Superuser Operation

System file /etc/apache2 was modified 4 times

System File Modification

The file /etc/ifconfig was downloaded and executed

Download and Execute

Process /bin/nc.openbsd scanned port 1234 on 26 IP Addresses

Port 1234 Scan

Process /etc/apache2 scanned port 1234 on 26 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 80 on 26 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 8080 on 26 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 1234 on 32 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 1234 on 30 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /bin/bash scanned port 1234 on 26 IP Addresses

Port 1234 Scan

The file /etc/apache2 was downloaded and executed 124 times

Download and Execute

Process /etc/apache2 generated outgoing network traffic to: 101.42.90.177:1234, 103.152.118.20:1234, 106.28.224.125:80, 106.28.224.125:8080, 117.16.44.111:1234, 118.41.204.72:1234, 120.236.78.194:1234, 120.31.133.162:1234, 121.105.50.80:80, 121.105.50.80:8080, 122.156.85.156:80, 122.156.85.156:8080, 13.223.223.77:80, 13.223.223.77:8080, 133.28.168.37:80, 133.28.168.37:8080, 137.130.57.181:80, 137.130.57.181:8080, 137.173.119.33:80, 137.173.119.33:8080, 152.151.119.224:80, 152.151.119.224:8080, 157.28.26.251:80, 157.28.26.251:8080, 158.211.116.248:80, 158.211.116.248:8080, 159.224.182.191:80, 160.30.153.182:80, 160.30.153.182:8080, 161.107.113.34:1234, 161.211.179.144:80, 161.211.179.144:8080, 161.70.98.32:1234, 169.116.18.141:80, 169.116.18.141:8080, 172.36.196.180:80, 172.36.196.180:8080, 172.64.130.4:443, 172.64.131.4:443, 174.103.34.148:80, 174.103.34.148:8080, 189.135.26.197:80, 189.135.26.197:8080, 190.60.239.44:1234, 191.242.188.103:1234, 193.9.92.148:80, 193.9.92.148:8080, 196.77.74.194:80, 196.77.74.194:8080, 202.61.203.229:1234, 203.139.217.53:80, 203.139.217.53:8080, 209.216.177.238:1234, 210.12.78.38:80, 210.12.78.38:8080, 212.223.212.210:80, 212.223.212.210:8080, 215.18.161.91:80, 215.18.161.91:8080, 218.146.15.97:1234, 222.100.124.62:1234, 222.121.63.87:1234, 222.134.240.92:1234, 25.110.173.29:80, 25.110.173.29:8080, 25.151.2.43:80, 25.151.2.43:8080, 34.235.191.69:80, 34.235.191.69:8080, 38.144.162.206:80, 4.105.182.217:80, 4.105.182.217:8080, 43.242.247.139:1234, 44.20.225.162:80, 44.20.225.162:8080, 46.13.164.29:1234, 49.233.159.222:1234, 51.159.19.47:1234, 51.75.146.174:443, 61.132.40.180:80, 61.132.40.180:8080, 64.227.132.175:1234, 66.223.180.31:80, 66.223.180.31:8080, 82.149.112.170:1234, 93.176.229.145:1234, 94.153.165.43:1234, 95.157.16.133:80 and 95.157.16.133:8080

Outgoing Connection

Process /etc/apache2 started listening on ports: 1234, 8088 and 8184

Listening

Process /etc/apache2 scanned port 80 on 32 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 8080 on 32 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 80 on 30 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /etc/apache2 scanned port 8080 on 30 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

The file /usr/local/bin/dash was downloaded and executed

Download and Execute

The file /usr/bin/uptime was downloaded and executed

Download and Execute

Connection was closed due to user inactivity