IntrusionLabs IntrusionLabs
← Back to feed

121.164.222.120

Threat Confidence
46%
Assessment
Port and service scanner
  • Ran 35 commands on the host.
  • Part of a 282-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR / Nowon-gu
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
60
Above average by volume
Agent Count
2
First / Last Seen
2026-10-13 04:12 — 2026-10-13 05:55
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
117 IPs 388827 events
2026-10-09 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on AWS. Scanning the same …
Multi-Agent Scan SCAN Active medium
192 IPs 818351 events
2026-09-28 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
183 IPs 557547 events
2026-09-24 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
40 IPs 132466 events
2026-09-24 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
158 IPs 588822 events
2026-09-24 — ongoing · 158 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
181 IPs 663453 events
2026-09-14 — ongoing · 181 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
206 IPs 503789 events
2026-09-11 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
202 IPs 779894 events
2026-09-10 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
59 IPs 97960 events
2026-09-01 — ongoing · 59 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 735229 events
2026-07-04 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 315378 events
2026-06-25 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 873931 events
2026-03-09 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
247 IPs 874212 events
2026-03-09 — ongoing · 247 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
282 IPs 1038944 events
2026-03-09 — ongoing · 282 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
259 IPs 941060 events
2026-03-09 — ongoing · 259 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
137 IPs 542358 events
2026-03-09 — ongoing · 137 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
175 IPs 600286 events
2026-03-09 — ongoing · 175 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
231 IPs 776924 events
2026-03-09 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
157 IPs 474956 events
2026-03-09 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
53 IPs 141476 events
2026-02-25 — ongoing · 53 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
211 IPs 849686 events
2026-02-24 — ongoing · 211 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
225 IPs 735747 events
2026-02-24 — ongoing · 225 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 642251 events
2026-02-24 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS4766 Korea Telecom ASN Active medium 🇰🇷 KR
206 IPs 93747 events
ftp:bruteforcesmtp:relayssh:bruteforcessh:connectionssh:intrusionssh:malwaressh:proxy-abusetelnet:bruteforcetelnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware
2026-02-18 — ongoing · 206 IPs from the same network (Korea Telecom, AS4766) were active during overlapping time periods. Temporal correlation across …
Session Forensics
scanner ×6 interactive_operator ×2
Sessions
8 (2 with login)
Avg Depth Score
0.34
Commands Executed
35
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Interactive Operator ff92e0839431 greencloud_phx_01 · 2026-10-13 05:55
24 1 90%
Loading events...
Interactive Operator 4980f378f748 greencloud_phx_01 · 2026-10-13 05:55
11 1 90%
Loading events...
Scanner 3ab0f9125761 w4m_singapore_01 · 2026-10-13 05:42
15%
Loading events...
Scanner 175e6e775fab w4m_singapore_01 · 2026-10-13 05:27
15%
Loading events...
Scanner f6901a4b384b w4m_singapore_01 · 2026-10-13 05:12
15%
Loading events...
Scanner 7db994c6a5aa w4m_singapore_01 · 2026-10-13 04:57
15%
Loading events...
Scanner 9a8147ef0d00 w4m_singapore_01 · 2026-10-13 04:42
15%
Loading events...
Scanner c4fcdcbae7ad w4m_singapore_01 · 2026-10-13 04:12
15%
Loading events...