The attacker established 2 SSH sessions using the credential administrator/1234 and made 4 port forwarding attempts to external destinations on ports 80 and 443 (128.199.207.131, 104.17.25.14, and 142.251.141.74), likely for establishing reverse prox ...
show moreThe attacker established 2 SSH sessions using the credential administrator/1234 and made 4 port forwarding attempts to external destinations on ports 80 and 443 (128.199.207.131, 104.17.25.14, and 142.251.141.74), likely for establishing reverse proxy or exfiltration channels. No commands were executed during the sessions.
show less
Attacker established 2 SSH sessions using credentials administrator/1234 with OpenSSH client version 10.0-hpn14v15, but executed no commands. The sessions focused on port forwarding reconnaissance, with 4 distinct forwarding attempts targeting extern ...
show moreAttacker established 2 SSH sessions using credentials administrator/1234 with OpenSSH client version 10.0-hpn14v15, but executed no commands. The sessions focused on port forwarding reconnaissance, with 4 distinct forwarding attempts targeting external hosts on ports 443 and 80, suggesting probing for command and control infrastructure or data exfiltration channels.
show less
Brute-Force
SSH
Hacking
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown
