Loading threats
Identifies an SSH session where the actor manipulates shell environment variables (such as HISTFILE, HISTSIZE, HISTCONTROL, or related variables) and reloads or reinitializes shell history in order to suppress, overwrite, or control command logging. The combination of explicitly setting environment variables and triggering a history reload indicates deliberate command history tampering rather than normal shell usage.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 109.122.200.74 | 99% | 172 | 172 | 🇸🇪 SE | AS8849 | 2026-04-09 |
| 213.167.209.125 | 99% | 63 | 63 | 🇷🇺 RU | AS12389 | 2026-04-08 |
| 223.228.43.133 | 99% | 52 | 52 | 🇮🇳 IN | AS45609 | 2026-02-27 |
| 106.216.247.28 | 98% | 48 | 48 | 🇮🇳 IN | AS45609 | 2026-03-03 |
| 223.228.35.140 | 98% | 44 | 44 | 🇮🇳 IN | AS45609 | 2026-02-18 |
| 117.99.254.230 | 98% | 40 | 40 | 🇮🇳 IN | AS45609 |
| 2026-02-27 |
| 95.90.238.122 | 94% | 34 | 34 | 🇩🇪 DE | AS3209 | 2026-02-18 |
| 5.77.193.132 | 91% | 32 | 32 | 🇦🇲 AM | AS44395 | 2026-02-26 |
| 106.192.135.153 | 97% | 25 | 25 | 🇮🇳 IN | AS45609 | 2026-02-18 |
| 37.215.43.216 | 93% | 24 | 24 | 🇧🇾 BY | AS6697 | 2026-04-08 |
| 113.203.71.126 | 86% | 24 | 24 | 🇮🇷 IR | AS197207 | 2026-02-20 |
| 45.157.233.15 | 93% | 23 | 23 | 🇩🇪 DE | AS58212 | 2026-02-20 |
| 185.254.99.219 | 93% | 22 | 22 | 🇩🇪 DE | AS58212 | 2026-02-20 |
| 94.143.231.253 | 93% | 21 | 21 | 🇩🇪 DE | AS58212 | 2026-02-20 |
| 45.157.233.56 | 92% | 18 | 18 | 🇩🇪 DE | AS58212 | 2026-02-20 |
| 194.9.6.115 | 92% | 18 | 18 | 🇩🇪 DE | AS58212 | 2026-02-20 |
| 58.186.5.172 | 94% | 16 | 16 | 🇻🇳 VN | AS18403 | 2026-04-08 |
| 5.216.80.46 | 91% | 13 | 13 | 🇮🇷 IR | AS197207 | 2026-02-18 |
| 171.249.162.26 | 93% | 13 | 13 | 🇻🇳 VN | AS7552 | 2026-04-08 |
| 185.254.97.196 | 85% | 13 | 13 | 🇩🇪 DE | AS58212 | 2026-02-21 |