This IP address has been reported a total of
22
times from
13 distinct
sources.
195.208.61.236 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 10
reports;
France
with 3
reports;
Korea (the Republic of)
with 2
reports.
The most common categories in these recent reports were:
Brute-Force
14
times;
SSH
13
times;
Hacking
7
times;
Port Scan
5
times;
Exploited Host
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Observed SSH login attempts with ftpuser/ftpuser and mailadmin/mailadmin, followed by interactive sh ...
show moreObserved SSH login attempts with ftpuser/ftpuser and mailadmin/mailadmin, followed by interactive shell activity in 2 sessions. The actor checked CPU count and top processes, then staged files named astats and kstats and wrote a shell script w.sh in /dev/shm and /tmp. The script was made executable and a crontab @reboot entry was added to persist and rerun w.sh after reboot. Process checks searched for astats and kstats names, indicating follow-up management of the dropped payloads. One dropped artifact was recovered: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.
show less
Observed login with ftpuser/ftpuser from SSH-2.0-Go. Attacker ran uname -a, cat /proc/cpuinfo | grep ...
show moreObserved login with ftpuser/ftpuser from SSH-2.0-Go. Attacker ran uname -a, cat /proc/cpuinfo | grep processor | wc -l, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and a shell loop to find writable directories (/dev/shm, /tmp, /var/run, /mnt, /root, /). Persistence was attempted by creating /tmp/w.sh, making it executable, and adding a crontab @reboot entry invoking /tmp/w.sh with arguments "astats" "netai" "kstats" and "ssh 2 az". A second persistence attempt created ~/.config/systemd/user/watcher-netai.service, then ran systemctl --user daemon-reload and systemctl --user enable --now watcher-netai.service. No downloads, payload execution, lateral movement, or artifacts/hashes were observed.
show less
propolis: 195.208.61.236 - 16 event(s) across 1 category since 2026-10-19T14:28:10.969875+00:00, cur ...
show morepropolis: 195.208.61.236 - 16 event(s) across 1 category since 2026-10-19T14:28:10.969875+00:00, current score 85.8
show less
propolis: 195.208.61.236 - 16 event(s) across 1 category since 2026-10-19T14:28:10.969875+00:00, cur ...
show morepropolis: 195.208.61.236 - 16 event(s) across 1 category since 2026-10-19T14:28:10.969875+00:00, current score 5.4
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
Observed SSH login using ubuntu/Ubuntu@1234 from SSH-2.0-Go. Post-auth activity created and staged f ...
show moreObserved SSH login using ubuntu/Ubuntu@1234 from SSH-2.0-Go. Post-auth activity created and staged files in /dev/shm, including w.sh, astats, and kstats, then prepared execution from /dev/shm with chmod +x on w.sh. The session queried CPU count, inspected top processes, and checked for running astats/kstats instances. It attempted persistence by reading the crontab and adding an @reboot entry invoking /dev/shm/w.sh with arguments including astats, netai, kstats, and ssh 2 az. It also attempted cleanup/anti-forensics by removing shell history and multiple log files, including utmp, wtmp, lastlog, secure, and yum.log. No file downloads, port forwards, or lateral movement were observed in this session.
show less
Unauthorized SSH access: 1 login attempt in the last 24 hours. After logging in it ran 8 commands in ...
show moreUnauthorized SSH access: 1 login attempt in the last 24 hours. After logging in it ran 8 commands in 1 session: system reconnaissance, persistence attempts.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
