Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 121.5.14.85Previously Malicious

IP Address: 121.5.14.85Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SCP

Tags

Successful SSH Login Port 22 Scan Download File Port 80 Scan Outgoing Connection 2 Shell Commands Port 8080 Scan Superuser Operation Listening SSH SCP

Associated Attack Servers

15.116.78.151 25.113.242.203 49.193.65.117 56.203.63.129 89.121.228.38 101.69.135.110 103.52.147.126 115.196.130.154 120.211.227.11 223.92.191.236

Basic Information

IP Address

121.5.14.85

Domain

-

ISP

Tencent cloud computing

Country

China

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-04-20

Last seen in Akamai Guardicore Segmentation

2022-04-29

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

/dev/shm/ifconfig was downloaded

Download File

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password

Successful SSH Login

A possibly malicious Superuser Operation was detected 2 times

Superuser Operation

Process /dev/shm/apache2 scanned port 22 on 12 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 80 on 12 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 8080 on 12 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 22 on 32 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 22 on 32 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 generated outgoing network traffic to: 1.120.251.241:80, 1.120.251.241:8080, 101.187.169.100:80, 101.187.169.100:8080, 101.69.135.110:1234, 103.52.147.126:1234, 104.21.25.86:443, 110.248.50.223:80, 110.248.50.223:8080, 115.101.150.49:80, 115.101.150.49:8080, 115.196.130.154:1234, 116.145.51.242:22, 120.211.227.11:1234, 126.125.246.205:80, 126.125.246.205:8080, 126.180.180.49:80, 126.180.180.49:8080, 14.202.45.242:80, 14.202.45.242:8080, 15.116.78.151:1234, 155.63.185.179:80, 155.63.185.179:8080, 166.35.197.102:80, 166.35.197.102:8080, 167.16.201.114:80, 167.16.201.114:8080, 172.67.133.228:443, 174.243.153.192:22, 177.233.70.36:80, 177.233.70.36:8080, 184.121.39.84:80, 184.121.39.84:8080, 188.62.77.227:22, 192.72.253.164:80, 192.72.253.164:8080, 20.112.11.33:80, 20.112.11.33:8080, 200.151.55.235:80, 200.151.55.235:8080, 201.208.202.96:22, 204.92.83.60:80, 204.92.83.60:8080, 220.117.188.68:22, 223.92.191.236:2222, 240.136.38.115:80, 240.136.38.115:8080, 242.243.170.32:80, 242.243.170.32:8080, 244.52.169.8:22, 25.113.242.203:2222, 3.51.112.82:80, 3.51.112.82:8080, 32.52.145.185:80, 32.52.145.185:8080, 36.46.43.240:80, 36.46.43.240:8080, 37.130.61.38:80, 37.130.61.38:8080, 39.175.68.100:1234, 41.111.232.235:80, 41.111.232.235:8080, 49.193.65.117:2222, 51.16.235.61:80, 51.16.235.61:8080, 51.75.146.174:443, 53.64.157.231:22, 56.203.63.129:2222, 64.26.27.55:80, 64.26.27.55:8080, 7.109.114.88:80, 7.109.114.88:8080, 74.112.12.34:22, 74.33.78.125:22, 80.166.230.15:80, 80.166.230.15:8080, 80.71.47.211:80, 80.71.47.211:8080, 82.139.174.109:22, 83.234.149.137:80, 83.234.149.137:8080, 86.3.228.79:80, 86.3.228.79:8080, 87.207.232.184:80, 87.207.232.184:8080, 89.121.228.38:1234, 89.232.36.169:80, 89.232.36.169:8080 and 94.24.231.246:22

Outgoing Connection

Process /dev/shm/apache2 started listening on ports: 1234, 8089 and 8184

Listening

Process /dev/shm/apache2 scanned port 80 on 32 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 8080 on 32 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 80 on 32 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 8080 on 32 IP Addresses

Port 22 Scan Port 80 Scan Port 8080 Scan

Connection was closed due to timeout