This IP address has been reported a total of
26
times from
8 distinct
sources.
57.129.171.59 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 15
reports;
France
with 4
reports;
Germany
with 3
reports.
The most common categories in these recent reports were:
SSH
21
times;
Brute-Force
16
times;
Hacking
10
times;
Exploited Host
3
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Unauthorized SSH access: 1 login attempt in the last 24 hours. After logging in it ran 8 commands in ...
show moreUnauthorized SSH access: 1 login attempt in the last 24 hours. After logging in it ran 8 commands in 1 session: system reconnaissance, persistence attempts.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
Single SSH session using credentials mailadmin/mailadmin from SSH-2.0-Go. Operator performed host re ...
show moreSingle SSH session using credentials mailadmin/mailadmin from SSH-2.0-Go. Operator performed host recon with cat /proc/cpuinfo, ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and process checks for astats and kstats. Dropped files via here-docs in /dev/shm and /, including w.sh, astats, and kstats, then made w.sh executable. Attempted persistence by adding an @reboot cron entry to run /dev/shm/w.sh with quoted args. Issued cleanup/removal commands for .bash_history, utmp, wtmp, lastlog, secure, and yum.log. Also probed writable directories with a shell loop over /dev/shm, /tmp, /var/run, /mnt, /root, and /. No downloads, port forwards, lateral movement, or hash artifacts observed.
show less
Observed 2 SSH sessions using root/M$uX_8z3D_m-AI=. The actor enumerated the host with uname -a, /pr ...
show moreObserved 2 SSH sessions using root/M$uX_8z3D_m-AI=. The actor enumerated the host with uname -a, /proc/cpuinfo, and ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, then searched writable locations by looping through /dev/shm, /tmp, /var/run, /mnt, /root, and /. They created /tmp/w.sh, set it executable, and dropped a 1.4 KB script named w.sh (sha256: bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28). They also checked crontab and attempted persistence with an @reboot cron entry pointing to /tmp/w.sh, plus a systemd user service at ~/.config/systemd/user/watcher-netai.service followed by systemctl --user daemon-reload and enable --now. No lateral movement, downloads, or additional payloads were observed in the session.
show less
Observed 2 SSH sessions using root/M$uX_8z3D_m-AI= via SSH-2.0-Go. Activity focused on staging persi ...
show moreObserved 2 SSH sessions using root/M$uX_8z3D_m-AI= via SSH-2.0-Go. Activity focused on staging persistence and host discovery: checked crontab, attempted to add an @reboot job for /tmp/w.sh, created /tmp/w.sh, and set executable permissions. Also attempted user-level persistence with ~/.config/systemd/user/watcher-netai.service followed by systemctl --user daemon-reload and enable --now. Recon included uname -a, /proc/cpuinfo processor count, process listing with ps -eo pid,pcpu,comm --sort=-pcpu | head -n 10, and probing writable/working directories under /dev/shm, /tmp, /var/run, /mnt, /root, and /. No downloads, lateral movement, or dropped artifacts were observed.
show less
propolis: 57.129.171.59 - 51 event(s) across 1 category since 2026-10-13T14:13:37.740396+00:00, curr ...
show morepropolis: 57.129.171.59 - 51 event(s) across 1 category since 2026-10-13T14:13:37.740396+00:00, current score 100.0
show less
propolis: 57.129.171.59 - 51 event(s) across 1 category since 2026-10-13T14:13:37.740396+00:00, curr ...
show morepropolis: 57.129.171.59 - 51 event(s) across 1 category since 2026-10-13T14:13:37.740396+00:00, current score 6.2
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
SSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard ...
show moreSSH honeypot: automated intrusion attempts against a personal decoy server (Server Guardian Warboard). Read-only capture.
show less
propolis: 57.129.171.59 - 34 event(s) across 1 category since 2026-10-13T14:13:37.740396+00:00, curr ...
show morepropolis: 57.129.171.59 - 34 event(s) across 1 category since 2026-10-13T14:13:37.740396+00:00, current score 27.6
show less
