IP Address: 203.232.110.106Previously Malicious
IP Address: 203.232.110.106Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Connect-Back, Scanner |
|
Services Targeted |
SCP SSH |
|
Tags |
Superuser Operation Listening SCP 2 Shell Commands Port 2222 Scan Successful SSH Login Port 22 Scan SSH Download File |
|
Associated Attack Servers |
|
IP Address |
203.232.110.106 |
|
|
Domain |
- |
|
|
ISP |
Korea Telecom |
|
|
Country |
Korea, Republic of |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2021-11-21 |
|
Last seen in Akamai Guardicore Segmentation |
2022-03-05 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List |
Successful SSH Login |
|
/dev/shm/ifconfig was downloaded |
Download File |
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password |
Successful SSH Login |
|
A possibly malicious Superuser Operation was detected 2 times |
Superuser Operation |
|
Process /dev/shm/ifconfig scanned port 22 on 41 IP Addresses |
Port 22 Scan Port 2222 Scan |
|
Process /dev/shm/ifconfig scanned port 22 on 49 IP Addresses |
Port 22 Scan Port 2222 Scan |
|
Process /dev/shm/ifconfig scanned port 2222 on 41 IP Addresses |
Port 22 Scan Port 2222 Scan |
|
Process /dev/shm/ifconfig started listening on ports: 1234 and 8086 |
Listening |
|
Process /dev/shm/ifconfig generated outgoing network traffic to: 101.68.121.111:22, 104.89.184.18:22, 109.152.140.209:22, 110.31.45.111:22, 111.216.218.137:2222, 117.48.135.40:22, 118.201.68.49:2222, 12.92.79.77:2222, 13.54.251.79:22, 132.67.131.77:2222, 134.33.34.207:2222, 141.183.96.201:2222, 142.124.38.52:2222, 142.33.105.3:22, 142.65.64.209:2222, 146.239.247.10:2222, 147.88.113.212:2222, 153.100.102.26:2222, 153.245.22.142:2222, 153.96.46.186:2222, 156.95.127.181:2222, 158.180.104.92:22, 159.44.161.149:22, 161.103.184.198:2222, 162.126.115.171:22, 168.157.70.215:22, 169.44.21.49:22, 173.14.166.96:22, 174.121.154.89:2222, 174.47.18.73:22, 174.68.198.208:22, 175.118.198.165:2222, 175.189.28.191:22, 177.147.35.21:22, 179.210.94.4:2222, 18.162.208.191:22, 185.226.225.117:2222, 190.127.121.215:2222, 198.71.24.41:2222, 2.46.109.206:22, 200.131.9.149:22, 207.15.198.251:22, 207.15.198.251:2222, 207.210.16.47:22, 209.55.184.153:2222, 209.94.140.140:22, 211.182.245.25:2222, 214.157.222.246:2222, 22.136.126.187:2222, 22.86.115.132:22, 222.149.242.249:2222, 222.225.146.55:22, 241.136.39.167:2222, 241.62.220.236:2222, 246.130.54.50:2222, 246.51.194.153:22, 250.7.109.231:22, 26.147.236.52:2222, 26.98.78.214:2222, 29.5.73.20:2222, 3.243.160.247:2222, 34.87.241.26:2222, 39.145.67.108:22, 43.233.100.40:2222, 44.104.58.209:22, 46.155.244.20:2222, 47.189.101.233:22, 47.77.29.114:2222, 60.193.185.51:2222, 60.82.115.78:22, 61.73.131.187:22, 64.7.251.194:2222, 67.163.157.145:2222, 67.76.236.14:2222, 71.206.106.207:22, 73.97.26.150:22, 76.20.197.253:2222, 81.144.23.83:22, 88.200.253.175:2222, 88.245.102.78:2222, 9.250.180.2:2222, 91.152.232.12:22, 91.9.2.157:22, 92.124.104.164:2222, 96.241.237.42:22, 96.241.237.42:2222, 98.144.161.81:22, 98.189.28.98:2222 and 98.70.139.90:22 |
|
|
Process /dev/shm/ifconfig scanned port 2222 on 49 IP Addresses |
Port 22 Scan Port 2222 Scan |
|
Connection was closed due to timeout |
|
© 2023 Akamai Technologies