This IP address has been reported a total of
20
times from
11 distinct
sources.
47.83.24.165 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
SSH login with pi/5Z@@P0me56gN$S# followed by malware staging and persistence setup. Attacker wrote ...
show moreSSH login with pi/5Z@@P0me56gN$S# followed by malware staging and persistence setup. Attacker wrote /tmp/w.sh, then created startup persistence with crontab @reboot entry to run /tmp/w.sh with arguments "astats" "netai" "kstats" "ssh 2 az". Also attempted to create files named astats and kstats in writable locations (/dev/shm, /tmp, /var/run, /mnt, /root, /). Commands checked CPU count and top CPU processes, then searched for running instances of astats and kstats while excluding system services. Cleanup commands deleted shell history and login/accounting logs: .bash_history, /var/run/utmp, /var/run/wtmp, /var/log/lastlog, yum.log, wtmp, secure. Dropped artifact: w.sh, script, 1.4 KB, sha256:bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.
show less
Single SSH session with no valid credentials captured. Attacker ran anti-forensics and file-drop sta ...
show moreSingle SSH session with no valid credentials captured. Attacker ran anti-forensics and file-drop staging commands only: created/redirected output to astats in /dev/shm, /tmp, /var/run, /mnt, /root, or /; then attempted to delete shell history and login/audit logs (.bash_history, /var/run/utmp, /var/run/wtmp, /var/log/lastlog, /usr/adm/lastlog, yum.log, wtmp, secure). No downloads, payload execution, persistence, lateral movement, or additional commands were observed.
show less
Single SSH login using pi/5Z@@P0me56gN$S# from SSH-2.0-Go. Activity focused on establishing persiste ...
show moreSingle SSH login using pi/5Z@@P0me56gN$S# from SSH-2.0-Go. Activity focused on establishing persistence and deploying files. Attacker created /tmp/w.sh and wrote to astats and kstats in writable directories, then added a crontab @reboot entry to run /tmp/w.sh. They also created a user-level systemd unit at ~/.config/systemd/user/watcher-netai.service and ran systemctl --user daemon-reload and enable --now. Recon included /proc/cpuinfo processor count and ps listings with filters for astats, kstats, systemd-networkd, ld-musl-x86_64, and rsyslogd. Commands show checks for existing persistence and process presence, plus directory probing across /dev/shm, /tmp, /var/run, /mnt, /root, and /. No downloads, lateral movement, or file hashes were observed.
show less