IntrusionLabs IntrusionLabs
← Back to feed

107.150.123.48

TAGGED SUSPICIOUS how we decide →
Why: Flagged by 2 external threat feeds, with 98 events seen by our sensors · certainty: circumstantial
Threat Confidence
67%
Assessment
  • Logged in with 2 different credentials across 4 logins.
  • Ran 50 commands on the host.
  • Active for 10 days, 2026-10-07 to 2026-10-17.
  • Part of a 282-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇭🇰 HK / Hong Kong
ASN
AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
Cloud Provider
—
Total Events
98
Above average by volume
Agent Count
3
First / Last Seen
2026-10-07 04:37 — 2026-10-17 17:10
Attack Types
ssh:bruteforce ssh:intrusion telnet:bruteforce telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1003.008 T1110 T1110.001
Discovery
T1083
External Corroboration
CINS Army
Reported 2026-10-19 05:01
cins:bad_reputation
Blocklist.de
Reported 2026-10-19 05:01
blocklist_de:reported
Campaigns
Multi-Agent Scan SCAN Active medium
117 IPs 388827 events
2026-10-09 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
121 IPs 428863 events
2026-10-07 — ongoing · 121 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
29 IPs 64515 events
2026-10-05 — ongoing · 29 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
59 IPs 26464 events
2026-10-05 — ongoing · 59 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
19 IPs 114389 events
2026-10-01 — ongoing · 19 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
158 IPs 764455 events
2026-10-01 — ongoing · 158 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
187 IPs 734158 events
2026-10-01 — ongoing · 187 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 592841 events
2026-10-01 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
145 IPs 252604 events
2026-10-01 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
35 IPs 109720 events
2026-10-01 — ongoing · 35 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
220 IPs 766244 events
2026-09-25 — ongoing · 220 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
183 IPs 557547 events
2026-09-24 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
3 IPs 407 events
2026-09-24 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
40 IPs 132466 events
2026-09-24 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
158 IPs 588822 events
2026-09-24 — ongoing · 158 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
11 IPs 54829 events
2026-09-23 — ongoing · 11 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
23 IPs 91085 events
2026-09-23 — ongoing · 23 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
104 IPs 286576 events
2026-09-22 — ongoing · 104 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
154 IPs 747089 events
2026-09-22 — ongoing · 154 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
10 IPs 19630 events
2026-09-20 — ongoing · 10 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
27 IPs 35408 events
2026-09-20 — ongoing · 27 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
52 IPs 178400 events
2026-09-14 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
153 IPs 568224 events
2026-09-14 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
181 IPs 663453 events
2026-09-14 — ongoing · 181 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
206 IPs 503789 events
2026-09-11 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 779894 events
2026-09-10 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
160 IPs 439857 events
2026-08-10 — ongoing · 160 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 735229 events
2026-07-04 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
190 IPs 795361 events
2026-06-29 — ongoing · 190 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 315378 events
2026-06-25 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
20 IPs 97943 events
2026-06-24 — ongoing · 20 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
6 IPs 5892 events
2026-06-06 — ongoing · 6 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 269295 events
2026-06-03 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 420054 events
2026-05-27 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
242 IPs 1014136 events
2026-05-22 — ongoing · 242 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 671667 events
2026-03-21 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 676970 events
2026-03-21 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 163164 events
2026-03-21 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
147 IPs 412743 events
2026-03-19 — ongoing · 147 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
247 IPs 874212 events
2026-03-09 — ongoing · 247 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
282 IPs 1038944 events
2026-03-09 — ongoing · 282 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 873931 events
2026-03-09 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
231 IPs 776924 events
2026-03-09 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 474956 events
2026-03-09 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
175 IPs 600286 events
2026-03-09 — ongoing · 175 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
219 IPs 867626 events
2026-03-09 — ongoing · 219 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 542358 events
2026-03-09 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
259 IPs 941060 events
2026-03-09 — ongoing · 259 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
129 IPs 274704 events
2026-03-07 — ongoing · 129 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
189 IPs 593557 events
2026-03-03 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
5 IPs 5456 events
2026-02-28 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
211 IPs 849686 events
2026-02-24 — ongoing · 211 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
225 IPs 735747 events
2026-02-24 — ongoing · 225 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED ASN Active medium 🇭🇰 HK
57 IPs 34650 events
ftp:bruteforcehttp:scanmysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusion
2026-02-18 — ongoing · 57 IPs from the same network (UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, AS135377) were active during overlapping time periods. …
Session Forensics
credential_probe ×4 interactive_operator ×2 opportunistic_bruter ×2
Sessions
8 (4 with login)
Avg Depth Score
0.45
Commands Executed
50
Files Downloaded
0
Notable Commands
  • id
  • cat /etc/passwd
  • echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
  • enable
  • system
  • system
  • shell
  • shell
  • sh
  • bash
  • enable
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
19532158b559096b89b1a5f7d17175b2
SSH Client
SSH-2.0-libssh2_1.11.1
Evidence Timeline
Interactive Operator 4f2a0a55d3bb w4m_seattle_01 · 2026-10-17 17:09
24 1 90%
Loading events...
Credential Probe 946a280654a4 w4m_seattle_01 · 2026-10-17 17:09
1 20%
Loading events...
Credential Probe 6b94f5bb490e w4m_seattle_01 · 2026-10-17 17:09
1 20%
Loading events...
Opportunistic Bruter 814295be2491 w4m_singapore_01 · 2026-10-12 23:13
1 50%
Loading events...
Credential Probe 8266c125876d w4m_singapore_01 · 2026-10-12 23:00
1 20%
Loading events...
Credential Probe 19ec89ccc94a w4m_singapore_01 · 2026-10-12 22:47
1 20%
Loading events...
Interactive Operator 0fd24c732549 greencloud_phx_01 · 2026-10-07 18:42
26 1 90%
Loading events...
Opportunistic Bruter 6f3870d15d84 greencloud_phx_01 · 2026-10-07 04:37
1 50%
Loading events...