Looking up IP
Check an IP Address, Domain Name, Subnet, or ASN
95.162.176.56 has a very high threat confidence level of 98%, originating from Iran, on the Rightel Communication Service Company PJS network (57218). It has been observed across 35 sessions targeting SSH, with detected attack patterns including ssh shell history tampering via environment reload, First observed on February 9, 2026, most recently active February 10, 2026.
Identifies an SSH session where the actor manipulates shell environment variables (such as HISTFILE, HISTSIZE, HISTCONTROL, or related variables) and reloads or reinitializes shell history in order to suppress, overwrite, or control command logging. The combination of explicitly setting environment variables and triggering a history reload indicates deliberate command history tampering rather than normal shell usage.