Check an IP Address, Domain Name, Subnet, or ASN
82.165.216.224 has a threat confidence score of 100%. This IP address from France (AS8560, IONOS SE) has been observed in 262 honeypot sessions targeting SSH protocols. Detected attack patterns include ssh post auth comprehensive host profiling, ssh post auth full host reconnaissance sweep. First observed on March 19, 2026, most recently active March 23, 2026.
Identifies structured post-authentication SSH activity consistent with automated host qualification and capability assessment. The session performs broad system enumeration including kernel and version queries, CPU and process inspection, network configuration and listening service discovery, service inventory via systemctl, credential file probing (/etc/passwd, /etc/shadow), hostname retrieval (command and file read), root and filesystem inspection, connectivity validation via ping, temporary file creation and cleanup, and command resolution checks to evaluate system suitability for further exploitation or staging.
Identifies structured post-authentication SSH activity consistent with automated host profiling. The session executes a broad enumeration sequence including system versioning, CPU details, network configuration, listening services, process snapshots, identity context, environment variables, filesystem inspection, and credential file probing to fingerprint the host and assess exploitation potential.