Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
154.144.243.138 has a threat confidence score of 100%. This IP address from Morocco (AS6713, Itissalat Al-MAGHRIB) has been observed in 227 honeypot sessions targeting SSH, TELNET protocols. Detected attack patterns include ssh hardened host profiling and shell rc immutability bypass, telnet shell escalation with busybox execution attempt. First observed on March 4, 2026, most recently active March 19, 2026.
Identifies SSH post-auth activity combining resilient multi-source CPU enumeration (explicit /usr/bin/nproc fallback) with removal of the immutable flag from ~/.shellrc via chattr, indicating host profiling followed by shell configuration tampering for persistence preparation.
Telnet session exhibiting privilege escalation and shell breakout commands (enable, system, shell, sh) followed by execution of /bin/busybox with a non-standard or arbitrary applet name. The sequence indicates an attempt to escape restricted CLI environments and execute a staged or randomly named payload via BusyBox. The presence of an unknown BusyBox applet strongly suggests automated bot deployment logic rather than legitimate administrative activity.