IntrusionLabs IntrusionLabs
← Back to feed

185.136.15.9

Threat Confidence
36%
Assessment
  • Part of a 416-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇿 KZ
ASN
AS210328 · AO ALMAZ
Cloud Provider
—
Total Events
3
Below average by volume
Agent Count
2
First / Last Seen
2026-10-22 21:35 — 2026-10-25 21:19
Attack Types
http:scan
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1190
External Corroboration
Not flagged by any external feeds
Campaigns
Subnet 185.136.15.0/24 SUBNET Active high 🇰🇿 KZ
6 IPs 28 events
http:scanssh:bruteforce
2026-10-22 — ongoing · 6 IPs from the same /24 subnet (185.136.15.0/24) were observed attacking our sensors within the same time window. …
Multi-Agent Scan SCAN Active medium
19 IPs 49963 events
2026-09-29 — ongoing · 19 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
261 IPs 721225 events
2026-09-24 — ongoing · 261 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
88 IPs 78433 events
2026-09-01 — ongoing · 88 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
387 IPs 1095898 events
2026-07-28 — ongoing · 387 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
416 IPs 1209617 events
2026-05-27 — ongoing · 416 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
57 IPs 62286 events
2026-05-27 — ongoing · 57 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
206 IPs 381377 events
2026-03-11 — ongoing · 206 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
web_probe ×3
Sessions
3
Avg Depth Score
0.25
Commands Executed
0
Files Downloaded
0
Evidence Timeline
Web Probe 02066f24fcf49fbb newark_01 · 2026-10-25 21:19
25%
Loading events...
Web Probe 2aa3e268c994f6bb w4m_seattle_01 · 2026-10-25 20:23
25%
Loading events...
Web Probe cd95b0432462679c w4m_seattle_01 · 2026-10-22 21:35
25%
Loading events...
Non-Session Events
Timestamp Port Proto Event Source Location
2026-10-25 21:19:55 :80 http HTTP GET request opencanary ewr
2026-10-25 20:23:05 :80 http HTTP GET request opencanary sea
2026-10-22 21:35:30 :80 http HTTP GET request opencanary sea