← Back to feed

116.52.252.150

TAGGED MALICIOUS how we decide →

Why: Our sensors observed data exfiltrator sessions · certainty: inferred

150.252.52.116.broad.km.yn.dynamic.163data.com.cn (163data.com.cn) ✗ FCrDNS

Threat Confidence

51%

Assessment

Uploads files to compromised hosts

Active for 11 days, 2026-10-03 to 2026-10-14.
Part of a 111-IP campaign from the same network, active in the same window.

Generated from the counts on this page by fixed rules; each line cites the number it rests on.

Location

🇨🇳 CN

ASN

AS4134 · Chinanet

Cloud Provider

—

Total Events

Average by volume

Agent Count

First / Last Seen

2026-10-03 08:41 — 2026-10-14 23:34

Attack Types

ssh:connection ssh:intrusion

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001

Initial Access

T1078

Execution

T1059.004

Discovery

T1046

Exfiltration

T1048

External Corroboration

Blocklist.de

Reported 2026-10-19 05:01

blocklist_de:reported

Campaigns

AS4134 Chinanet ASN Active medium 🇨🇳 CN

111 IPs 12291 events

ftp:bruteforcehttp:scanmysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connection

2026-02-18 — ongoing · 111 IPs from the same network (Chinanet, AS4134) were active during overlapping time periods. Temporal correlation across a …

Session Forensics

scanner ×1 data_exfiltrator ×1

Sessions

2 (1 with login)

Avg Depth Score

0.53

Commands Executed

Files Downloaded

Fingerprints

1 SSH client banner · 1 HASSH fingerprint

HASSH

98ddc5604ef6a1006a2b49a58759fbe6

SSH Client

SSH-2.0-Go

Evidence Timeline

Data Exfiltrator b7d82cbfc948 w4m_seattle_01 · 2026-10-14 23:30

1 90%

Loading events...

Scanner 825ce34e294c w4m_singapore_01 · 2026-10-03 08:41

15%

Loading events...