Loading threats
Unsets common locale and shell environment variables (LANG, LANGUAGE, LC_*, HUMAN_BLOCKS, LS_COLORS) to normalize command output and remove localization artifacts, then performs basic filesystem reconnaissance by executing pwd and ls -la after redundant cd . directory checks. This pattern is commonly used by automated SSH post-authentication scripts to ensure predictable command output across different system locales before enumerating the current working directory contents.
| IP Address | Risk | Events | Sessions | Country | ASN | Last Seen |
|---|---|---|---|---|---|---|
| 185.20.12.97 | 70% | 228 | 68 | 🇸🇪 SE | AS44136 | 2026-02-25 |
| 49.118.77.98 | 83% | 184 | 84 | 🇨🇳 CN | AS4134 | 2026-03-07 |
| 131.161.142.254 | 83% | 55 | 55 | 🇧🇷 BR | AS263077 | 2026-03-07 |
| 177.129.222.128 | 60% | 45 | 45 | 🇧🇷 BR | AS271644 | 2026-03-08 |
| 151.242.11.252 | 76% | 39 | 39 | 🇭🇰 HK | AS212336 | 2026-03-07 |
| 141.11.246.235 | 55% | 32 | 32 | 🇳🇱 NL | AS43350 |
| 2026-02-22 |
| 36.50.57.101 | 60% | 21 | 21 | 🇮🇩 ID | AS152029 | 2026-02-23 |
| 82.24.200.48 | 76% | 20 | 20 | 🇺🇸 US | AS397423 | 2026-03-12 |
| 185.241.206.102 | 30% | 17 | 17 | 🇳🇱 NL | AS3920 | 2026-03-06 |
| 91.243.167.4 | 29% | 17 | 7 | 🇮🇷 IR | AS59573 | 2026-02-27 |
| 49.118.71.253 | 62% | 15 | 15 | 🇨🇳 CN | AS4134 | 2026-03-07 |
| 14.176.210.17 | 43% | 15 | 15 | 🇻🇳 VN | AS45899 | 2026-02-22 |
| 5.190.74.151 | 60% | 14 | 14 | 🇮🇷 IR | AS58224 | 2026-02-23 |
| 146.70.98.101 | 56% | 13 | 13 | 🇧🇷 BR | AS9009 | 2026-03-06 |
| 185.209.196.249 | 50% | 7 | 7 | 🇩🇪 DE | AS39351 | 2026-03-15 |
| 5.190.250.238 | 47% | 5 | 5 | 🇮🇷 IR | AS58224 | 2026-02-21 |
| 193.32.248.164 | 41% | 4 | 4 | 🇩🇪 DE | AS39351 | 2026-03-06 |
| 185.65.164.117 | 33% | 2 | 2 | 🇬🇧 GB | AS199775 | 2026-03-05 |
| 89.37.63.108 | 35% | 2 | 2 | 🇸🇪 SE | AS212238 | 2026-03-05 |
| 171.251.233.170 | 35% | 2 | 2 | 🇻🇳 VN | AS7552 | 2026-02-18 |