IntrusionLabs IntrusionLabs
← Back to feed

112.163.135.28

TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
Threat Confidence
73%
Assessment
Hands-on intruder: runs interactive command sessions
  • Ran 140 commands on the host.
  • Active for 17 days, 2026-09-30 to 2026-10-18.
  • Part of a 274-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR / Geoje-si
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
196
Above average by volume
Agent Count
3
First / Last Seen
2026-09-30 14:41 — 2026-10-18 11:07
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
201 IPs 746162 events
2026-10-11 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
74 IPs 62390 events
2026-10-04 — ongoing · 74 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
37 IPs 177597 events
2026-10-01 — ongoing · 37 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
187 IPs 734158 events
2026-10-01 — ongoing · 187 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
10 IPs 44976 events
2026-09-30 — ongoing · 10 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 763077 events
2026-09-29 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
52 IPs 54594 events
2026-09-26 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
52 IPs 25733 events
2026-09-24 — ongoing · 52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
244 IPs 944988 events
2026-09-24 — ongoing · 244 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
163 IPs 583865 events
2026-09-23 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
241 IPs 899891 events
2026-09-16 — ongoing · 241 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 696407 events
2026-09-14 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 269295 events
2026-06-03 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
73 IPs 74036 events
2026-06-03 — ongoing · 73 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 376963 events
2026-05-27 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
110 IPs 473472 events
2026-04-20 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
17 IPs 16274 events
2026-04-17 — ongoing · 17 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
90 IPs 542843 events
2026-04-02 — ongoing · 90 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
160 IPs 741409 events
2026-03-21 — ongoing · 160 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 618504 events
2026-03-21 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
99 IPs 163164 events
2026-03-21 — ongoing · 99 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 671667 events
2026-03-21 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
193 IPs 676970 events
2026-03-21 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
224 IPs 812091 events
2026-03-19 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
274 IPs 1029231 events
2026-03-19 — ongoing · 274 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
206 IPs 751766 events
2026-03-09 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
229 IPs 811798 events
2026-03-09 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
176 IPs 511887 events
2026-03-04 — ongoing · 176 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
190 IPs 760651 events
2026-03-03 — ongoing · 190 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
20 IPs 181363 events
2026-02-24 — ongoing · 20 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS4766 Korea Telecom ASN Active medium 🇰🇷 KR
208 IPs 93672 events
ftp:bruteforcesmtp:relayssh:bruteforcessh:connectionssh:intrusionssh:malwaressh:proxy-abusetelnet:bruteforcetelnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware
2026-02-18 — ongoing · 208 IPs from the same network (Korea Telecom, AS4766) were active during overlapping time periods. Temporal correlation across …
Session Forensics
scanner ×2 interactive_operator ×8
Sessions
10 (8 with login)
Avg Depth Score
0.75
Commands Executed
140
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Scanner 9cbb1ece2f41 w4m_singapore_01 · 2026-10-18 11:07
15%
Loading events...
Scanner cab0048e8979 newark_01 · 2026-10-13 00:08
15%
Loading events...
Interactive Operator 153f1d675a92 greencloud_phx_01 · 2026-10-01 02:32
24 1 90%
Loading events...
Interactive Operator 2e4ce8b3a4cc greencloud_phx_01 · 2026-10-01 02:32
11 1 90%
Loading events...
Interactive Operator 64a37fbf12e6 greencloud_phx_01 · 2026-10-01 02:17
24 1 90%
Loading events...
Interactive Operator fd305dfaf03c greencloud_phx_01 · 2026-10-01 02:17
11 1 90%
Loading events...
Interactive Operator 22ed3c9b44f6 greencloud_phx_01 · 2026-10-01 02:01
24 1 90%
Loading events...
Interactive Operator 5b130b5e62db greencloud_phx_01 · 2026-10-01 02:01
11 1 90%
Loading events...
Interactive Operator d0f9ce00c6ac greencloud_phx_01 · 2026-09-30 14:41
24 1 90%
Loading events...
Interactive Operator 4242ab23031f greencloud_phx_01 · 2026-09-30 14:41
11 1 90%
Loading events...