Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 66.70.154.59Previously Malicious

IP Address: 66.70.154.59Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Connect-Back, Scanner

Services Targeted

SCP SSH

Tags

SSH Superuser Operation SCP Download File Download and Allow Execution Successful SSH Login Download and Execute

Associated Attack Servers

active24.cz atomonetworks.com vps.co.ve

3.125.183.25 31.14.115.42 31.15.12.26 31.165.5.154 35.174.113.238 42.117.20.129 52.51.113.157 59.1.226.211 103.153.81.202 120.224.34.31 123.132.238.210 124.223.14.100 125.161.27.96 143.198.133.234 146.56.115.253 152.242.43.89 157.245.137.18 172.64.110.32 172.64.111.32 172.64.200.11 172.64.201.11 185.227.123.118 187.6.3.3 188.93.232.104 191.96.34.2 209.216.177.238 218.146.15.97 221.181.232.56 222.117.95.174

Basic Information

IP Address

66.70.154.59

Domain

-

ISP

OVH Hosting

Country

Canada

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2018-12-23

Last seen in Akamai Guardicore Segmentation

2022-10-31

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password

Successful SSH Login

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 7 times

Successful SSH Login

A possibly malicious Superuser Operation was detected 26 times

Superuser Operation

The file /etc/ifconfig was downloaded and executed 6 times

Download and Execute

The file /etc/apache2 was downloaded and executed 177 times

Download and Execute

Process /etc/apache2 generated outgoing network traffic to: 172.64.201.11:443

Outgoing Connection

Process /etc/apache2 started listening on ports: 1234, 8086 and 8184

Listening

The file /root/ifconfig was downloaded and executed 5 times

Download and Execute

The file /root/apache2 was downloaded and executed 153 times

Download and Execute

Process /root/ifconfig started listening on ports: 1234, 8085 and 8186

Listening

Process /root/ifconfig generated outgoing network traffic to: 172.64.200.11:443

Outgoing Connection

The file /tmp/ifconfig was downloaded and executed 10 times

Download and Execute

The file /tmp/apache2 was downloaded and executed 176 times

Download and Execute

Process /tmp/ifconfig generated outgoing network traffic to: 172.64.200.11:443, 222.121.63.87:1234 and 80.147.162.151:1234

Outgoing Connection

Process /tmp/ifconfig started listening on ports: 1234, 8089 and 8184

Listening

Process /tmp/ifconfig attempted to access suspicious domains: t-ipconnect.de

Access Suspicious Domain Outgoing Connection

The file /etc/ifconfig was downloaded and executed 5 times

Download and Execute

The file /etc/apache2 was downloaded and executed 50 times

Download and Execute

Process /etc/ifconfig generated outgoing network traffic to: 172.64.201.11:443

Outgoing Connection

Process /etc/ifconfig started listening on ports: 1234, 8082 and 8187

Listening

./ifconfig was downloaded 2 times

Download File

The file /root/ifconfig was downloaded and executed 5 times

Download and Execute

The file /root/apache2 was downloaded and executed 145 times

Download and Execute

Process /root/apache2 started listening on ports: 1234, 8082, 8088 and 8184

Listening

Process /root/apache2 generated outgoing network traffic to: 117.16.44.111:1234, 120.31.133.162:1234, 172.64.200.11:443, 172.64.201.11:443, 222.134.240.91:1234, 223.171.91.127:1234 and 61.77.105.219:1234

Outgoing Connection

Process /root/apache2 attempted to access suspicious domains: eflydns.net

Access Suspicious Domain Outgoing Connection

/dev/shm/ifconfig was downloaded

Download File

Process /dev/shm/ifconfig generated outgoing network traffic to: 120.31.133.162:1234, 172.64.201.11:443 and 206.189.25.255:1234

Outgoing Connection

Process /dev/shm/ifconfig started listening on ports: 1234, 8083 and 8180

Listening

The file /var/tmp/ifconfig was downloaded and executed 5 times

Download and Execute

The file /var/tmp/apache2 was downloaded and executed 42 times

Download and Execute

Process /var/tmp/apache2 started listening on ports: 1234, 8081 and 8181

Listening

Process /var/tmp/apache2 generated outgoing network traffic to: 172.64.201.11:443

Outgoing Connection

/tmp/ifconfig was downloaded

Download File

Process /dev/shm/ifconfig attempted to access suspicious domains: eflydns.net

Access Suspicious Domain Outgoing Connection

Process /tmp/apache2 generated outgoing network traffic to: 172.64.201.11:443

Outgoing Connection

Process /tmp/apache2 started listening on ports: 1234, 8081 and 8183

Listening

The file /root/ifconfig was downloaded and executed 8 times

Download and Execute

The file /root/apache2 was downloaded and executed 61 times

Download and Execute

Process /root/ifconfig generated outgoing network traffic to: 172.64.200.11:443 and 80.147.162.151:1234

Outgoing Connection

Process /root/ifconfig started listening on ports: 1234, 8089 and 8189

Listening

The file /root/apache2 was downloaded and executed 92 times

Download and Execute

The file /root/ifconfig was downloaded and executed 2 times

Download and Execute

Process /root/ifconfig attempted to access suspicious domains: t-ipconnect.de

Access Suspicious Domain Outgoing Connection

Process /root/ifconfig started listening on ports: 1234, 8085 and 8186

Listening

Process /root/ifconfig generated outgoing network traffic to: 172.64.201.11:443

Outgoing Connection

Connection was closed due to user inactivity

Associated Files

/var/tmp/ifconfig

SHA256: 3b9707d2b3c510499a866fe655f57f05eba1eb55566b03979602e5b9d6616a05

655360 bytes

/var/tmp/ifconfig

SHA256: 861921d16b4f8870dda3d79aecaa828b713b8e41b29ec977aca10c236356144e

1507328 bytes

/var/tmp/ifconfig

SHA256: 915f410de5799b81704f3695d8aa38d5da78b01b60cea17d3e0c3f162f9b0e9b

1802240 bytes

/var/tmp/ifconfig

SHA256: 93b5387c1ad89b1bba7a1c7ad722d5406dd174e58cd0a1de5a0684e02a83fd33

1474560 bytes

/var/tmp/ifconfig

SHA256: a80d6167fc74455cfb7b08d51deba3201b3fb93786022b8d00d99f959920178a

2981888 bytes

/var/tmp/ifconfig

SHA256: b2712bdabd192560eb201c14818ff1368c742242fee50fb164ef9f84142462fc

2031616 bytes

/var/tmp/ifconfig

SHA256: b3b7551f344bdc4021e89ae74961531531a7dedf23e7b2d0364e21d052271ae2

1114112 bytes

/root/ifconfig

SHA256: f28c1becc58c6ae5d449da0b0f68f4def9db80ba792ab4486a7177e0ecd62b74

851968 bytes