This IP address has been reported a total of
47
times from
14 distinct
sources.
46.36.216.132 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 22
reports;
Korea (the Republic of)
with 10
reports;
Germany
with 9
reports.
The most common categories in these recent reports were:
Brute-Force
43
times;
SSH
31
times;
Hacking
14
times;
Exploited Host
11
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
Observed SSH login attempts with ftpuser/ftpuser and hadoop/hadoop from an SSH-2.0-Go client. After ...
show moreObserved SSH login attempts with ftpuser/ftpuser and hadoop/hadoop from an SSH-2.0-Go client. After access, the host was used for shell activity focused on persistence and process checks. Commands queried CPU count and running processes, then checked for existing astats and kstats processes. The actor created /dev/shm/w.sh, wrote astats and kstats via cat redirection, and made w.sh executable. A cron persistence check was performed with crontab -l, then an @reboot entry was prepared to run /dev/shm/w.sh with arguments including astats and netai. The session also issued multiple log-cleaning commands removing .bash_history, utmp/wtmp/lastlog, yum.log, secure, and wtmp/secure remnants. Working directories were tested across /dev/shm, /tmp, /var/run, /mnt, /root, and /. No downloads, lateral movement, or dropped-file artifacts were observed in this session.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
Observed 2 SSH sessions using mailadmin/mailadmin. Attacker ran uname -a, ps -eo pid,pcpu,comm --sor ...
show moreObserved 2 SSH sessions using mailadmin/mailadmin. Attacker ran uname -a, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, cat /proc/cpuinfo | grep processor | wc -l, and a directory check across /dev/shm /tmp /var/run /mnt /root /. They then changed to /tmp, created w.sh, and made it executable. The dropped file w.sh is a 1.4 KB script (sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28). They also attempted persistence by reading crontab and appending an @reboot entry targeting /tmp/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". No lateral movement, port forwards, or downloads were observed.
show less
propolis: 46.36.216.132 - 17 event(s) across 1 category since 2026-10-09T17:03:39.149979+00:00, curr ...
show morepropolis: 46.36.216.132 - 17 event(s) across 1 category since 2026-10-09T17:03:39.149979+00:00, current score 99.5
show less
propolis: 46.36.216.132 - 17 event(s) across 1 category since 2026-10-09T17:03:39.149979+00:00, curr ...
show morepropolis: 46.36.216.132 - 17 event(s) across 1 category since 2026-10-09T17:03:39.149979+00:00, current score 6.2
show less
Two SSH sessions from SSH-2.0-Go used the credential mailadmin/mailadmin. The actor ran basic host r ...
show moreTwo SSH sessions from SSH-2.0-Go used the credential mailadmin/mailadmin. The actor ran basic host recon (uname -a, CPU core count via /proc/cpuinfo, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10) and searched for a writable directory. They used cd "/tmp" && if [ ! -f "w.sh" ]; then cat > "w.sh" && chmod +x w.sh; fi to stage /tmp/w.sh, then attempted persistence with crontab by adding an @reboot entry referencing /tmp/w.sh and arguments "astats" "netai" "kstats" "ssh 2 az". No download, malware payload, lateral movement, or port forwarding was observed in the captured activity.
show less
2 SSH sessions using ftpuser/ftpuser over 12 seconds. Attacker enumerated the system with uname -a, ...
show more2 SSH sessions using ftpuser/ftpuser over 12 seconds. Attacker enumerated the system with uname -a, CPU core count via /proc/cpuinfo, and ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10. They tested writable locations with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'. They then created /tmp/w.sh, made it executable, and dropped a 1.4 KB script named w.sh. They attempted persistence by checking crontab and adding an @reboot entry invoking /tmp/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". No additional downloads, lateral movement, or other payloads were observed. Artifact: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28
show less
SSH brute-force login using ftpuser/ftpuser from SSH-2.0-Go. After login, attacker ran uname -a, enu ...
show moreSSH brute-force login using ftpuser/ftpuser from SSH-2.0-Go. After login, attacker ran uname -a, enumerated CPU count with cat /proc/cpuinfo | grep processor | wc -l, checked top processes with ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and searched writable locations with sh -c 'for d in /dev/shm /tmp /var/run /mnt /root /; do cd "$d" 2>/dev/null && pwd && break; done'. Persistence was attempted by reading crontab and adding an @reboot entry for /tmp/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". They then moved to /tmp and began staging /tmp/w.sh with a here-doc and chmod +x. No downloads, lateral movement, or dropped-file artifacts were observed.
show less
