Active Threat • MEDIUM

206.189.53.8

Country of Origin🇩🇪 Germany

First Detection4/27/2026

Last Activity4/27/2026

ISPDigitalOcean, LLC

🎯

154

Total Attacks

🔌

Ports

📡

Attack Types

🦠

Malware

Geolocation

Country: 🇩🇪 Germany
City: Frankfurt am Main
ASN: AS14061
ISP: DigitalOcean, LLC

Attack Types

ssh_telnet_honeypot

Attacked Ports

Associated Malware

09a3e612f8cad1560057...→28720365c5e7476a011e...→28ba533b0f3c4df63d6b...→3f1f9a5db692d999bb3d...→50e721e49c013f00c62c...→

Attempted Credentials

🔐root/12qw12qw

🔐root/Qaz123456@

🔐root/pass@word123$%^

🔐root/123abc

🔐bbs/bbsroot

🔐tangwenhao/root512

🔐root/1!2!3!

🔐root/hy@bas5200

🔐root/P@$$vords1234

🔐root/123cxzdsaewq

🔐root/1QaZ2WsX!@

🔐root/4121284911e84cc8s0a0d4i4

🔐root/disaisi@2026

🔐tangwenhao/3245gs5662d34

🔐root/nokia

Executed Commands

$Enter new UNIX password:2x

$ls -lh $(which ls)1x

$cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'1x

$uname -a1x

$echo "root512\n46LzwVIf4MDv\n46LzwVIf4MDv\n"|passwd1x

$w1x

$cat /proc/cpuinfo | grep name | wc -l1x

$crontab -l1x

$cat /proc/cpuinfo | grep model | grep name | wc -l1x

$which ls1x

Shodan InternetDB ExposureShodan

InternetDB data, not real-time

Ports

22567868818080

CPEs

cpe:/o:canonical:ubuntu_linuxcpe:/a:n8n:n8ncpe:/a:openbsd:openssh:10.0p2cpe:/a:nodejs:nodejs

Risk Assessment

/100

LowMediumHighCritical