Loading threats
Chained shell execution that navigates to the user’s home directory, removes the existing .ssh directory (rm -rf .ssh), recreates it, appends a provided public key to .ssh/authorized_keys, and applies restrictive permissions (chmod -R go=). This sequence effectively replaces existing SSH access configuration and installs a new authorized key for persistent access under the current user account.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 152.53.184.147 | 100% | 157,059 | 3,823 | 🇦🇹 AT | AS197540 | 2026-03-17 |
| 47.83.232.179 | 96% | 35,476 | 21,899 | 🇭🇰 HK | AS45102 | 2026-03-09 |
| 47.82.7.61 | 92% | 14,623 | 12,653 | 🇸🇬 SG | AS45102 | 2026-04-13 |
| 8.222.249.57 | 96% | 13,834 | 13,796 | 🇸🇬 SG | AS45102 | 2026-03-24 |
| 47.83.11.34 | 96% | 13,726 | 8,731 | 🇭🇰 HK | AS45102 | 2026-03-09 |
| 45.186.251.70 | 100% | 12,223 | 3,411 | 🇧🇷 BR | AS269455 | 2026-04-02 |
| 47.239.101.17 | 94% | 10,110 | 10,110 | 🇭🇰 HK | AS45102 | 2026-04-14 |
| 14.63.196.175 | 100% | 9,436 | 5,638 | 🇰🇷 KR | AS4766 | 2026-04-18 |
| 187.188.0.71 | 100% | 9,013 | 2,824 | 🇲🇽 MX | AS22884 | 2026-02-25 |
| 94.198.1.136 | 89% | 8,654 | 8,626 | 🇷🇺 RU | AS48148 | 2026-04-09 |
| 58.98.199.45 | 100% | 6,902 | 2,390 | 🇯🇵 JP | AS9595 | 2026-03-02 |
| 103.63.108.25 | 100% | 6,051 | 5,802 | 🇻🇳 VN | AS38732 | 2026-04-18 |
| 8.218.216.204 | 94% | 6,024 | 6,012 | 🇭🇰 HK | AS45102 | 2026-03-20 |
| 46.191.141.152 | 100% | 5,636 | 3,070 | 🇷🇺 RU | AS24955 | 2026-03-26 |
| 20.203.42.204 | 100% | 4,334 | 3,991 | 🇦🇪 AE | AS8075 | 2026-04-18 |
| 210.79.142.221 | 100% | 4,177 | 1,191 | 🇮🇩 ID | AS141607 | 2026-03-25 |
| 187.16.96.250 | 100% | 3,986 | 2,116 | 🇧🇷 BR | AS17222 | 2026-04-18 |
| 58.98.197.137 | 100% | 3,968 | 3,963 | 🇯🇵 JP | AS9595 | 2026-04-13 |
| 95.188.91.101 | 100% | 3,776 | 1,292 | 🇷🇺 RU | AS12389 | 2026-02-27 |
| 102.88.137.80 | 100% | 3,545 | 2,414 | 🇳🇬 NG | AS29465 | 2026-04-18 |