This IP address has been reported a total of
12
times from
6 distinct
sources.
159.242.254.216 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 9
reports;
Switzerland
with 1
report;
Germany
with 1
report.
The most common categories in these recent reports were:
Brute-Force
9
times;
SSH
8
times;
Hacking
2
times;
Web App Attack
1
time;
Port Scan
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
http-cve-probing - IP: 159.242.254.216 - time="2026-10-13T01:28:28+02:00" level=info msg="(555f66b4 ...
show morehttp-cve-probing - IP: 159.242.254.216 - time="2026-10-13T01:28:28+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-cve-probing by ip 159.242.254.216 (US/23481) : 4h ban on Ip 159.242.254.216" module=db
show less
Single SSH login using ubuntu/Ubuntu@1234. Attacker dropped /tmp/w.sh (script, 1.4 KB, sha256:bc36e7 ...
show moreSingle SSH login using ubuntu/Ubuntu@1234. Attacker dropped /tmp/w.sh (script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28), set it executable, and tried to install persistence by appending an @reboot crontab entry to run the script. Commands show host profiling and environment prep: uname -a, CPU core count from /proc/cpuinfo, top CPU processes via ps, and a search for writable directories before working in /tmp. No lateral movement, downloads, or additional commands were observed in this session.
show less
Single SSH session using ubuntu/Ubuntu@1234 from an SSH-2.0-Go client. Attacker ran uname -a, enumer ...
show moreSingle SSH session using ubuntu/Ubuntu@1234 from an SSH-2.0-Go client. Attacker ran uname -a, enumerated CPU count with /proc/cpuinfo, and listed top processes with ps. It probed writable locations with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'. It then created /tmp/w.sh via cd "/tmp" && if [ ! -f "w.sh" ]; then cat > "w.sh" && chmod +x w.sh; fi and attempted persistence by reading crontab and adding an @reboot entry pointing to /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". No downloads, lateral movement, or hashes/artifacts observed.
show less
propolis: 159.242.254.216 - 16 event(s) across 1 category since 2026-10-12T03:31:55.665946+00:00, cu ...
show morepropolis: 159.242.254.216 - 16 event(s) across 1 category since 2026-10-12T03:31:55.665946+00:00, current score 96.0
show less
propolis: 159.242.254.216 - 16 event(s) across 1 category since 2026-10-12T03:31:55.665946+00:00, cu ...
show morepropolis: 159.242.254.216 - 16 event(s) across 1 category since 2026-10-12T03:31:55.665946+00:00, current score 6.0
show less
Observed one SSH login using ubuntu/ubuntu123 over SSH-2.0-Go. The session ran a setup/persistence s ...
show moreObserved one SSH login using ubuntu/ubuntu123 over SSH-2.0-Go. The session ran a setup/persistence sequence: checked crontab, then attempted to add an @reboot entry to execute /dev/shm/w.sh with quoted arguments. It created /dev/shm/w.sh and made it executable, then redirected input to create files named astats and kstats in writable directories. It enumerated CPU cores and top processes, then checked for existing astats/kstats processes. Cleanup commands deleted shell history and log files including utmp, wtmp, lastlog, secure, and yum.log. No download URLs, malware payloads, or lateral movement were observed in the provided activity.
show less
Single SSH session using credentials ubuntu/Ubuntu@1234 from SSH-2.0-Go. Activity focused on checkin ...
show moreSingle SSH session using credentials ubuntu/Ubuntu@1234 from SSH-2.0-Go. Activity focused on checking system capacity (cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10) and deploying persistence in /dev/shm. Commands created or staged /dev/shm/w.sh, /dev/shm/astats, and /dev/shm/kstats; a crontab entry was added to run /dev/shm/w.sh at @reboot. The session also checked for existing astats and kstats processes. Cleanup commands attempted to erase shell and system logs and histories: .bash_history, /var/run/utmp, /var/run/wtmp, /var/log/lastlog, /usr/adm/lastlog, /home/yum.log, /var/log/wtmp, /var/log/secure. No downloads, malware file artifacts, port forwards, or lateral movement were observed.
show less
