IntrusionLabs IntrusionLabs
← Back to feed

184.4.59.154

TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed opportunistic bruter sessions · certainty: inferred
184-4-59-154.phnx.centurylink.net (centurylink.net) ✗ FCrDNS
Threat Confidence
46%
Assessment
Gains access by password guessing, then takes no action
  • Part of a 280-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US / San Tan Valley
ASN
AS209 · CenturyLink Communications, LLC
Cloud Provider
—
Total Events
21
Average by volume
Agent Count
2
First / Last Seen
2026-10-21 13:41 — 2026-10-21 13:41
Attack Types
telnet:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
6 IPs 4184 events
2026-10-20 — ongoing · 6 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
280 IPs 964137 events
2026-09-22 — ongoing · 280 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
56 IPs 134533 events
2026-05-29 — ongoing · 56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
256 IPs 943537 events
2026-03-21 — ongoing · 256 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
217 IPs 814480 events
2026-03-04 — ongoing · 217 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
162 IPs 329059 events
2026-03-04 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
credential_probe ×1 opportunistic_bruter ×1
Sessions
2 (1 with login)
Avg Depth Score
0.35
Commands Executed
0
Files Downloaded
0
Evidence Timeline
Opportunistic Bruter a75b9715379e greencloud_phx_01 · 2026-10-21 13:41
1 50%
Loading events...
Credential Probe ac93af5d8d31 w4m_seattle_01 · 2026-10-21 13:41
1 20%
Loading events...