← Back to feed

165.154.138.79

mail.shegertravel.com (shegertravel.com) ✗ FCrDNS

Threat Confidence

40%

Assessment

Port and service scanner

Part of a 282-IP campaign probing the same targets.

Generated from the counts on this page by fixed rules; each line cites the number it rests on.

Location

🇩🇪 DE / Frankfurt am Main

ASN

AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED

Cloud Provider

—

Total Events

Average by volume

Agent Count

First / Last Seen

2026-10-12 06:48 — 2026-10-12 19:05

Attack Types

http:scan ssh:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Initial Access

T1190

Discovery

T1046

External Corroboration

CINS Army

Reported 2026-10-19 05:01

cins:bad_reputation

Campaigns

Multi-Agent Scan SCAN Active medium

121 IPs 428863 events

2026-10-07 — ongoing · 121 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …

Multi-Agent Scan SCAN Active medium

172 IPs 675803 events

2026-10-04 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …

Multi-Agent Scan SCAN Active medium

134 IPs 490075 events

2026-10-02 — ongoing · 134 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

56 IPs 79235 events

2026-09-28 — ongoing · 56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

95 IPs 334671 events

2026-09-24 — ongoing · 95 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

144 IPs 707169 events

2026-09-23 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

27 IPs 35408 events

2026-09-20 — ongoing · 27 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

251 IPs 987103 events

2026-09-18 — ongoing · 251 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

181 IPs 663453 events

2026-09-14 — ongoing · 181 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

153 IPs 568224 events

2026-09-14 — ongoing · 153 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

206 IPs 503789 events

2026-09-11 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

203 IPs 686346 events

2026-09-11 — ongoing · 203 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

202 IPs 779894 events

2026-09-10 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

196 IPs 742073 events

2026-09-08 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

69 IPs 197840 events

2026-08-13 — ongoing · 69 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

207 IPs 810722 events

2026-08-12 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

124 IPs 629914 events

2026-08-12 — ongoing · 124 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

183 IPs 625029 events

2026-08-12 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

191 IPs 646714 events

2026-07-04 — ongoing · 191 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

110 IPs 492585 events

2026-05-29 — ongoing · 110 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

143 IPs 503090 events

2026-04-13 — ongoing · 143 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

120 IPs 614524 events

2026-03-16 — ongoing · 120 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

247 IPs 874212 events

2026-03-09 — ongoing · 247 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …

Multi-Agent Scan SCAN Active medium

282 IPs 1038944 events

2026-03-09 — ongoing · 282 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

219 IPs 867626 events

2026-03-09 — ongoing · 219 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

259 IPs 941060 events

2026-03-09 — ongoing · 259 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

157 IPs 474956 events

2026-03-09 — ongoing · 157 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

231 IPs 776924 events

2026-03-09 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

240 IPs 907440 events

2026-03-08 — ongoing · 240 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

136 IPs 295925 events

2026-03-07 — ongoing · 136 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

197 IPs 662040 events

2026-03-03 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

87 IPs 173469 events

2026-02-27 — ongoing · 87 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

109 IPs 201716 events

2026-02-24 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

171 IPs 550204 events

2026-02-24 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Cloudflare. Scanning the same …

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED ASN Active medium 🇭🇰 HK

57 IPs 34650 events

ftp:bruteforcehttp:scanmysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusion

2026-02-18 — ongoing · 57 IPs from the same network (UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, AS135377) were active during overlapping time periods. …

Session Forensics

scanner ×4 web_probe ×1

Sessions

Avg Depth Score

0.17

Commands Executed

Files Downloaded

Fingerprints

3 SSH client banners · 1 HASSH fingerprint

HASSH

b893695067f94c8d2ed92025b192c636

SSH Client

\xfc\xf8}\xbc)\xf4C\xd3N{\x81\xe0jv-{\xd63wU"a\x86\xf8\xf4<\xd7\xf39 qt\xf6SSH-1.5-ServerSSH-2.0-OpenSSH_7.4

Evidence Timeline

Scanner fb4787dacc27 newark_01 · 2026-10-12 19:05

15%

Loading events...

Scanner ca255498f244 newark_01 · 2026-10-12 19:05

15%

Loading events...

Scanner 38bea162e309 newark_01 · 2026-10-12 19:05

15%

Loading events...

Scanner 1786ca1d4912 newark_01 · 2026-10-12 19:05

15%

Loading events...

Web Probe 4c48fa7362cf1892 w4m_seattle_01 · 2026-10-12 06:48

25%

Loading events...

Non-Session Events

Timestamp	Port	Proto	Event	Source	Location
2026-10-12 06:48:09	:80	http	HTTP GET request	opencanary	sea