IntrusionLabs IntrusionLabs
← Back to feed

176.98.13.44

TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
176.98.13.44.crystal.in.ua (crystal.in.ua) ✗ FCrDNS
Threat Confidence
57%
Assessment
Hands-on intruder: runs interactive command sessions
  • Ran 35 commands on the host.
  • Part of a 215-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇦 UA / Vasylkiv
ASN
AS49889 · Crystal Telecom Ltd
Cloud Provider
—
Total Events
50
Above average by volume
Agent Count
2
First / Last Seen
2026-10-20 00:13 — 2026-10-21 22:58
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
170 IPs 591917 events
2026-04-10 — ongoing · 170 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 526545 events
2026-04-10 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
25 IPs 138785 events
2026-03-21 — ongoing · 25 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
215 IPs 829593 events
2026-03-21 — ongoing · 215 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
208 IPs 898922 events
2026-03-21 — ongoing · 208 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
24 IPs 15265 events
2026-03-14 — ongoing · 24 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 interactive_operator ×2
Sessions
3 (2 with login)
Avg Depth Score
0.65
Commands Executed
35
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Scanner 0e67c43a6710 newark_01 · 2026-10-21 22:58
15%
Loading events...
Interactive Operator 4161e086df1c greencloud_phx_01 · 2026-10-20 00:13
24 1 90%
Loading events...
Interactive Operator 6ba8d39a6d8c greencloud_phx_01 · 2026-10-20 00:13
11 1 90%
Loading events...