Loading threats
Identifies SSH post-auth activity combining resilient multi-source CPU enumeration (explicit /usr/bin/nproc fallback) with removal of the immutable flag from ~/.shellrc via chattr, indicating host profiling followed by shell configuration tampering for persistence preparation.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 129.212.187.248 | 100% | 5,636 | 771 | 🇺🇸 US | AS14061 | 2026-03-02 |
| 87.106.213.49 | 99% | 4,304 | 4,215 | 🇫🇷 FR | AS8560 | 2026-03-05 |
| 129.212.186.6 | 100% | 2,369 | 597 | 🇺🇸 US | AS14061 | 2026-03-02 |
| 139.59.68.31 | 100% | 1,924 | 1,924 | 🇮🇳 IN | AS14061 | 2026-03-02 |
| 162.243.212.243 | 99% | 1,808 | 1,808 | 🇺🇸 US | AS14061 | 2026-03-03 |
| 170.64.150.143 | 99% | 1,619 | 1,595 | 🇦🇺 AU | AS14061 | 2026-03-01 |
| 167.172.56.3 | 100% | 1,614 | 1,548 | 🇬🇧 GB | AS14061 | 2026-03-12 |
| 167.71.5.5 | 99% | 1,416 | 1,416 | 🇳🇱 NL | AS14061 | 2026-03-03 |
| 144.126.225.181 | 97% | 1,390 | 1,390 | 🇬🇧 GB | AS14061 | 2026-03-01 |
| 139.59.12.76 | 99% | 1,378 | 1,378 | 🇮🇳 IN | AS14061 | 2026-03-01 |
| 147.182.210.207 | 99% | 1,366 | 1,366 | 🇺🇸 US | AS14061 | 2026-03-02 |
| 77.42.88.138 | 100% | 1,365 | 1,088 | 🇫🇮 FI | AS24940 | 2026-03-22 |
| 139.59.71.7 | 99% | 1,347 | 1,339 | 🇮🇳 IN | AS14061 | 2026-03-03 |
| 209.38.22.48 | 91% | 1,327 | 1,319 | 🇦🇺 AU | AS14061 | 2026-02-23 |
| 209.38.23.245 | 100% | 1,309 | 1,294 | 🇦🇺 AU | AS14061 | 2026-03-01 |
| 165.22.204.254 | 98% | 1,300 | 430 | 🇳🇱 NL | AS14061 | 2026-03-02 |
| 142.93.143.156 | 98% | 1,287 | 868 | 🇳🇱 NL | AS14061 | 2026-03-02 |
| 178.128.117.178 | 98% | 1,258 | 1,254 | 🇸🇬 SG | AS14061 | 2026-02-24 |
| 170.64.212.50 | 99% | 1,194 | 1,180 | 🇦🇺 AU | AS14061 | 2026-03-01 |
| 139.59.89.73 | 99% | 1,180 | 1,180 | 🇮🇳 IN | AS14061 | 2026-03-01 |