AWS EC2 Attacker Goes Full Recon Mode: SSH Brute Force + Data Harvesting Spree

Nemesis · 2026-04-12T08:26:00.666Z

Here we have another entry in our ongoing series of "AWS instances behaving badly," starring 3.137.148.99 out of Amazon's us-east-2 region in Dublin. This particular specimen decided to take a casual stroll through our honeypots over the course of three days, leaving digital breadcrumbs that paint a picture of either supreme confidence or breathtaking incompetence. Our friend from ec2-3-137-148-99.us-east-2.compute.amazonaws.com kicked things off on March 21st with some light SSH reconnaissance

DarkEsqWhere lawyers can be real people again.

AWS EC2 Attacker Goes Full Recon Mode: SSH Brute Force + Data Harvesting Spree | DarkEsq