IntrusionLabs IntrusionLabs
← Back to feed

119.193.183.53

TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
Threat Confidence
63%
Assessment
Hands-on intruder: runs interactive command sessions
  • Ran 105 commands on the host.
  • Active for 17 days, 2026-10-01 to 2026-10-18.
  • Part of a 220-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR / Pocheon-si
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
146
Above average by volume
Agent Count
2
First / Last Seen
2026-10-01 04:20 — 2026-10-18 14:05
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
CINS Army
Reported 2026-10-19 05:01
cins:bad_reputation
Campaigns
Multi-Agent Scan SCAN Active medium
59 IPs 26464 events
2026-10-05 — ongoing · 59 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
73 IPs 316457 events
2026-10-01 — ongoing · 73 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
26 IPs 22879 events
2026-10-01 — ongoing · 26 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
151 IPs 594198 events
2026-09-28 — ongoing · 151 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
220 IPs 766244 events
2026-09-25 — ongoing · 220 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
56 IPs 34024 events
2026-09-24 — ongoing · 56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 770260 events
2026-09-24 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
215 IPs 871920 events
2026-09-08 — ongoing · 215 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
2 IPs 432 events
2026-06-10 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Vultr. Scanning the same …
Multi-Agent Scan SCAN Active medium
193 IPs 420054 events
2026-05-27 — ongoing · 193 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
16 IPs 2198 events
2026-04-14 — ongoing · 16 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
32 IPs 115983 events
2026-04-04 — ongoing · 32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 618504 events
2026-03-21 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
139 IPs 717867 events
2026-03-03 — ongoing · 139 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
165 IPs 785467 events
2026-03-03 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
107 IPs 440218 events
2026-03-01 — ongoing · 107 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS4766 Korea Telecom ASN Active medium 🇰🇷 KR
208 IPs 93672 events
ftp:bruteforcesmtp:relayssh:bruteforcessh:connectionssh:intrusionssh:malwaressh:proxy-abusetelnet:bruteforcetelnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware
2026-02-18 — ongoing · 208 IPs from the same network (Korea Telecom, AS4766) were active during overlapping time periods. Temporal correlation across …
Session Forensics
scanner ×1 interactive_operator ×6
Sessions
7 (6 with login)
Avg Depth Score
0.79
Commands Executed
105
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Interactive Operator 3203af90cde8 greencloud_phx_01 · 2026-10-18 14:05
24 1 90%
Loading events...
Interactive Operator c2910f27af0a greencloud_phx_01 · 2026-10-18 14:05
11 1 90%
Loading events...
Interactive Operator f8ca4fd8a364 greencloud_phx_01 · 2026-10-18 04:24
24 1 90%
Loading events...
Interactive Operator 40a2ac1bc05f greencloud_phx_01 · 2026-10-18 04:24
11 1 90%
Loading events...
Scanner dce86eb1b8ed newark_01 · 2026-10-11 14:01
15%
Loading events...
Interactive Operator a4f07368e213 greencloud_phx_01 · 2026-10-01 04:20
24 1 90%
Loading events...
Interactive Operator f1e6de189303 greencloud_phx_01 · 2026-10-01 04:20
11 1 90%
Loading events...