IntrusionLabs IntrusionLabs
← Back to feed

152.32.138.230

TAGGED SUSPICIOUS how we decide →
Threat Confidence
30%
Location
🇰🇷 KR / Seoul
ASN
AS135377 · UCLOUD INFORMATION TECHNOLOGY HK LIMITED
Cloud Provider
—
Total Events
14
Average by volume
Agent Count
1
First / Last Seen
2026-03-10 06:19 — 2026-05-07 15:50
Attack Types
http:scan mysql:bruteforce ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1190
Credential Access
T1110 T1110.001
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED ASN Active medium 🇭🇰 HK
29 IPs 13316 events
ftp:bruteforcehttp:scanmysql:bruteforcessh:bruteforce
2026-02-18 — ongoing · 29 IPs from the same network (UCLOUD INFORMATION TECHNOLOGY HK LIMITED, AS135377) were active during overlapping time periods. …
Session Forensics
scanner ×4 web_probe ×1 mysql_probe ×1
Sessions
6
Avg Depth Score
0.18
Commands Executed
0
Files Downloaded
0
Fingerprints
HASSH
b893695067f94c8d2ed92025b192c636
SSH Client
\xfc\xf8$\xb9AB*\xc1\xe0\xcdء\xf3WH4\x98\xaa\xf0\xd0\xdf6\x82 R\xad%t0\x8f lG\x9bX\x97\xcbMl_\xe5\x90\xf3LXS\x83\xa2^\x983L\xaek\xb4NPt\xe8,4̨̩\xc0/\xc00\xc0+\xc0,\xc0 \x9ę̪3=\xc0SSH-1.5-ServerSSH-2.0-OpenSSH_7.4
Evidence Timeline
Scanner 1e27e7cba8ec w4m_singapore_01 · 2026-05-07 15:50
15%
Loading events...
Scanner caa9a35afdea w4m_singapore_01 · 2026-05-07 15:50
15%
Loading events...
Scanner 26f7a9d7cdd8 w4m_singapore_01 · 2026-05-07 15:49
15%
Loading events...
Scanner 98fe784b24ed w4m_singapore_01 · 2026-05-07 15:49
15%
Loading events...
MySQL Probe 9632dbc1ed0f1e4c w4m_singapore_01 · 2026-04-21 15:50
1 20%
Loading events...
Web Probe 5e0c8e02a7f459f5 w4m_singapore_01 · 2026-03-10 06:19
25%
Loading events...
Non-Session Events
Timestamp Port Proto Event Source Location
2026-04-21 15:50:52 :3306 mysql MySQL connection opencanary sin
2026-03-10 06:19:40 :80 http HTTP GET request opencanary sin