Log in to view charts and search reports for this IP.
Log In
No reports in the last 60 days
170.64.229.238 has been reported 271
times. The most recent report is from
.
The full history is preserved below and remains searchable. A
0% score reflects the absence of recent activity, but
this is not a guarantee that earlier reports were invalid. Abuse confidence score decays,
naturally, over time, when the abusive activity stops.
SSH-2.0-Go client established 2 sessions using weak creds (root/1, root/root). Attacker disabled immutable attributes on bash/zsh rc files via chattr -i to enable backdoor injection into shell init scripts. Commands executed: PATH reset, hostname/ker ...
show moreSSH-2.0-Go client established 2 sessions using weak creds (root/1, root/root). Attacker disabled immutable attributes on bash/zsh rc files via chattr -i to enable backdoor injection into shell init scripts. Commands executed: PATH reset, hostname/kernel enumeration via uname, uptime from /proc/uptime. Pattern suggests automated reconnaissance script assessing system config before persistence installation. Opportunistic credential-based access, likely mass scanning targeting default/weak SSH creds. No malware downloads, C2 beacons, or lateral movement observed. Demonstrates capability to modify shell configs with intent to inject malicious code into startup scripts for persistent access. Recommend: rotate root credentials, implement key-based auth only, restrict SSH via firewall, monitor bash/zsh rc files for unauthorized mods, review auth logs for compromise indicators.
show less
Mar 11 14:17:07 excalibur sshd[3050547]: Connection closed by authenticating user root 170.64.229.238 port 53760 [preauth]
Mar 11 14:18:28 excalibur sshd[3054742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhos ...
show moreMar 11 14:17:07 excalibur sshd[3050547]: Connection closed by authenticating user root 170.64.229.238 port 53760 [preauth]
Mar 11 14:18:28 excalibur sshd[3054742]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=170.64.229.238 user=root
Mar 11 14:18:30 excalibur sshd[3054742]: Failed password for root from 170.64.229.238 port 53986 ssh2
...
show less