Check an IP Address, Domain Name, Subnet, or ASN
80.67.167.81 has a threat confidence score of 80%. This IP address from France (AS2027, MilkyWan Association) has been observed in 55 honeypot sessions targeting SSH protocols. This IP is a known Tor exit node. Detected attack patterns include ssh comprehensive host reconnaissance sequence, ssh post auth system census with credential probe. First observed on January 28, 2026, most recently active April 16, 2026.
Identifies an SSH session performing broad system, network, identity, filesystem, and service enumeration in a single execution sequence. The behavior combines environment fingerprinting (kernel, CPU, uptime), user and credential surface inspection (/etc/passwd, /etc/shadow, history), network topology discovery (interfaces, routes, listening ports), process and service inventory, writable directory validation, and connectivity testing. This pattern reflects automated post-compromise host profiling used by botnets, cryptominers, and lateral-movement frameworks to determine system suitability and operational value.
Automated SSH session performing a structured full-system census following successful authentication. The activity enumerates kernel, hardware, memory, environment variables, network topology, listening services, running processes, mounted filesystems, and root directories while probing /etc/passwd and /etc/shadow, validating command availability, and performing temporary file write/delete tests. The pattern indicates scripted post-compromise host inventory and credential surface validation prior to persistence or payload deployment.