This IP address has been reported a total of
2
times from
2 distinct
sources.
203.205.13.199 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
China
with 1
report;
United States of America
with 1
report.
The most common categories in these recent reports were:
Brute-Force
2
times;
SSH
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Observed 2 SSH sessions using SSH-2.0-Go with credentials mailadmin/MhS+xYL#-OpmE0@. Activity focuse ...
show moreObserved 2 SSH sessions using SSH-2.0-Go with credentials mailadmin/MhS+xYL#-OpmE0@. Activity focused on downloading/planting files in writable locations and setting persistence. Commands created /dev/shm/w.sh with chmod +x, wrote files named astats and kstats, and checked for these processes with ps/grep. The actor queried CPU count and top processes, indicating host profiling. Persistence was attempted via crontab modification to run /dev/shm/w.sh at reboot, with a grep check for the scheduled entry. Cleanup/anti-forensics commands removed shell history and log files including /var/run/utmp, /var/run/wtmp, /var/log/lastlog, /var/log/wtmp, and /var/log/secure. No lateral movement, port forwarding, or completed download URLs were observed in the captured commands.
show less
