IntrusionLabs IntrusionLabs
← Back to feed

102.182.212.12

TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
102-182-212-12.ip.afrihost.joburg (afrihost.joburg) ✓ FCrDNS
Threat Confidence
47%
Assessment
Hands-on intruder: runs interactive command sessions
  • Ran 136 commands on the host.
  • Part of a 245-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇿🇦 ZA / Johannesburg
ASN
AS37611 · AFRIHOST SP (PTY) LTD
Cloud Provider
—
Total Events
252
Above average by volume
Agent Count
2
First / Last Seen
2026-09-28 05:28 — 2026-10-01 16:08
Attack Types
telnet:bruteforce telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Ended medium
3 IPs 498 events
2026-09-28 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS37611 AFRIHOST SP (PTY) LTD ASN Ended medium 🇿🇦 ZA
5 IPs 516 events
ssh:bruteforcessh:connectionssh:intrusiontelnet:bruteforcetelnet:connectiontelnet:intrusion
2026-09-28 — ongoing · 5 IPs from the same network (AFRIHOST SP (PTY) LTD, AS37611) were active during overlapping time periods. Temporal …
Multi-Agent Scan SCAN Active medium
10 IPs 4588 events
2026-09-28 — ongoing · 10 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
6 IPs 16336 events
2026-09-28 — ongoing · 6 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
126 IPs 417663 events
2026-09-28 — ongoing · 126 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Ended medium
2 IPs 272 events
2026-09-28 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Ended medium
3 IPs 456 events
2026-09-28 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Ended medium
4 IPs 425 events
2026-09-28 — ongoing · 4 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
119 IPs 406511 events
2026-09-28 — ongoing · 119 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Ended medium
3 IPs 397 events
2026-09-27 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
8 IPs 25188 events
2026-09-26 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
5 IPs 7086 events
2026-09-23 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
130 IPs 363418 events
2026-09-17 — ongoing · 130 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
105 IPs 54646 events
2026-09-17 — ongoing · 105 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
161 IPs 134001 events
2026-09-14 — ongoing · 161 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
197 IPs 545680 events
2026-05-27 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
3 IPs 6788 events
2026-05-13 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Ended medium
2 IPs 269 events
2026-05-07 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
217 IPs 524708 events
2026-04-20 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 519697 events
2026-04-16 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
173 IPs 142158 events
2026-04-16 — ongoing · 173 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
228 IPs 520040 events
2026-04-15 — ongoing · 228 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
190 IPs 521045 events
2026-04-15 — ongoing · 190 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Ended medium
3 IPs 483 events
2026-03-29 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
210 IPs 531622 events
2026-03-29 — ongoing · 210 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
168 IPs 356850 events
2026-03-29 — ongoing · 168 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
245 IPs 563656 events
2026-03-26 — ongoing · 245 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
243 IPs 579567 events
2026-03-23 — ongoing · 243 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
3 IPs 490 events
2026-03-21 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
15 IPs 31840 events
2026-03-14 — ongoing · 15 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
3 IPs 1463 events
2026-03-04 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 547771 events
2026-02-28 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
151 IPs 109047 events
2026-02-28 — ongoing · 151 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Session Forensics
scanner ×6 interactive_operator ×9 opportunistic_bruter ×1
Sessions
16 (10 with login)
Avg Depth Score
0.59
Commands Executed
136
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Scanner ea304b34f30c w4m_singapore_01 · 2026-10-01 16:07
15%
Loading events...
Scanner 1a49289c4365 w4m_singapore_01 · 2026-10-01 16:08
15%
Loading events...
Scanner 1d17613a4c06 w4m_singapore_01 · 2026-10-01 16:07
15%
Loading events...
Scanner 0d6d792d34a9 w4m_singapore_01 · 2026-10-01 16:07
15%
Loading events...
Scanner b56f65bbf504 w4m_singapore_01 · 2026-10-01 16:07
15%
Loading events...
Scanner 93eedc955ad1 w4m_singapore_01 · 2026-10-01 16:07
15%
Loading events...
Interactive Operator e4b840b0e711 greencloud_phx_01 · 2026-09-28 05:29
24 1 90%
Loading events...
Interactive Operator 5571af9366c7 greencloud_phx_01 · 2026-09-28 05:29
11 1 90%
Loading events...
Interactive Operator 3e85c698bbe0 greencloud_phx_01 · 2026-09-28 05:28
24 1 90%
Loading events...
Interactive Operator b1ae1bf0c9de greencloud_phx_01 · 2026-09-28 05:28
11 1 90%
Loading events...
Interactive Operator 190663bfd743 greencloud_phx_01 · 2026-09-28 05:28
24 1 90%
Loading events...
Opportunistic Bruter 3b56e54cd2ca greencloud_phx_01 · 2026-09-28 05:28
1 50%
Loading events...
Interactive Operator efd40aa0f3cc greencloud_phx_01 · 2026-09-28 05:28
10 1 90%
Loading events...
Interactive Operator 1fcfb4debead greencloud_phx_01 · 2026-09-28 05:28
10 1 90%
Loading events...
Interactive Operator 216a150ec36c greencloud_phx_01 · 2026-09-28 05:28
11 1 90%
Loading events...
Interactive Operator 6affbf50fcfc greencloud_phx_01 · 2026-09-28 05:28
11 1 90%
Loading events...