Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 200.46.133.19Previously Malicious

IP Address: 200.46.133.19Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SCP

Tags

Successful SSH Login Port 8080 Scan 6 Shell Commands Listening SSH SCP Outgoing Connection Superuser Operation Port 80 Scan Download File Port 1234 Scan

Associated Attack Servers

123.132.238.210 123.187.31.65 161.35.79.199 209.216.177.158

Basic Information

IP Address

200.46.133.19

Domain

-

ISP

Cable Onda

Country

Panama

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-07-28

Last seen in Akamai Guardicore Segmentation

2022-08-03

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

Process /bin/bash scanned port 1234 on 26 IP Addresses

Port 1234 Scan

Process /dev/shm/apache2 scanned port 1234 on 26 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 80 on 26 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 8080 on 26 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 1234 on 32 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 1234 on 28 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /bin/nc.openbsd scanned port 1234 on 26 IP Addresses

Port 1234 Scan

Process /bin/bash scanned port 1234 on 26 IP Addresses

Port 1234 Scan

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 2 times

Successful SSH Login

/dev/shm/ifconfig was downloaded

Download File

A possibly malicious Superuser Operation was detected 2 times

Superuser Operation

Process /dev/shm/apache2 generated outgoing network traffic to: 101.42.90.177:1234, 102.114.100.244:80, 102.114.100.244:8080, 103.152.118.20:1234, 103.90.177.102:1234, 104.21.25.86:443, 111.53.11.130:1234, 116.17.16.234:80, 116.17.16.234:8080, 117.120.50.51:80, 117.16.44.111:1234, 117.54.14.169:1234, 117.80.212.33:1234, 120.31.133.162:1234, 122.144.80.34:80, 122.144.80.34:8080, 124.115.231.214:1234, 140.95.179.222:80, 150.107.95.20:1234, 151.151.168.205:80, 151.151.168.205:8080, 161.35.79.199:1234, 165.49.113.59:80, 165.49.113.59:8080, 172.67.133.228:443, 173.18.35.41:1234, 174.182.23.39:80, 174.182.23.39:8080, 178.119.66.186:80, 178.119.66.186:8080, 182.224.177.56:1234, 185.56.31.84:80, 185.56.31.84:8080, 188.66.152.33:80, 19.147.139.117:80, 19.147.139.117:8080, 191.242.188.103:1234, 192.20.133.57:80, 192.20.133.57:8080, 192.43.102.150:80, 192.43.102.150:8080, 193.215.149.243:80, 193.215.149.243:8080, 194.36.86.50:80, 194.36.86.50:8080, 196.27.81.115:80, 204.68.61.227:80, 204.68.61.227:8080, 210.99.20.194:1234, 217.48.92.79:80, 217.48.92.79:8080, 220.243.148.80:1234, 222.103.98.58:1234, 222.133.22.142:80, 222.133.22.142:8080, 222.165.136.99:1234, 223.171.91.127:1234, 223.171.91.149:1234, 223.171.91.160:1234, 223.181.90.184:80, 223.181.90.184:8080, 243.53.63.124:80, 243.53.63.124:8080, 26.118.42.189:80, 26.118.42.189:8080, 26.54.127.176:80, 26.54.127.176:8080, 26.68.182.173:80, 26.68.182.173:8080, 3.113.91.246:80, 3.113.91.246:8080, 3.175.33.77:80, 3.175.33.77:8080, 31.13.112.147:80, 31.13.112.147:8080, 51.75.146.174:443, 52.131.32.110:1234, 57.159.118.239:80, 57.159.118.239:8080, 58.229.125.66:1234, 66.106.168.122:80, 66.106.168.122:8080, 7.72.181.73:80, 7.72.181.73:8080, 76.118.229.70:80, 76.118.229.70:8080 and 82.149.112.170:1234

Outgoing Connection

Process /dev/shm/apache2 started listening on ports: 1234, 8085 and 8189

Listening

Process /dev/shm/apache2 scanned port 80 on 32 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 8080 on 32 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 80 on 28 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Process /dev/shm/apache2 scanned port 8080 on 28 IP Addresses

Port 1234 Scan Port 80 Scan Port 8080 Scan

Connection was closed due to timeout