IntrusionLabs IntrusionLabs
← Back to feed

187.180.70.140

bbb4468c.virtua.com.br (virtua.com.br) ✗ FCrDNS
Threat Confidence
66%
Assessment
Port and service scanner
  • Ran 70 commands on the host.
  • Active for 13 days, 2026-10-01 to 2026-10-15.
  • Part of a 239-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇧🇷 BR / Belém
ASN
AS28573 · Claro NXT Telecomunicacoes Ltda
Cloud Provider
—
Total Events
126
Above average by volume
Agent Count
3
First / Last Seen
2026-10-01 19:55 — 2026-10-15 03:08
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
180 IPs 297685 events
2026-09-28 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
201 IPs 522926 events
2026-09-25 — ongoing · 201 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
204 IPs 781973 events
2026-09-17 — ongoing · 204 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 579416 events
2026-09-14 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
228 IPs 655728 events
2026-09-14 — ongoing · 228 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
146 IPs 359949 events
2026-08-26 — ongoing · 146 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
136 IPs 490150 events
2026-08-25 — ongoing · 136 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
212 IPs 519000 events
2026-06-07 — ongoing · 212 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
129 IPs 570305 events
2026-04-15 — ongoing · 129 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 502817 events
2026-04-15 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
223 IPs 592213 events
2026-04-15 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 683505 events
2026-04-15 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
172 IPs 686889 events
2026-04-15 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
132 IPs 642132 events
2026-04-15 — ongoing · 132 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
175 IPs 409511 events
2026-03-21 — ongoing · 175 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 573388 events
2026-03-09 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
199 IPs 698655 events
2026-03-09 — ongoing · 199 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
174 IPs 459120 events
2026-03-09 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
155 IPs 457912 events
2026-03-09 — ongoing · 155 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 617965 events
2026-03-09 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
239 IPs 632595 events
2026-03-02 — ongoing · 239 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
164 IPs 561736 events
2026-03-01 — ongoing · 164 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
203 IPs 722247 events
2026-02-27 — ongoing · 203 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
148 IPs 188989 events
2026-02-26 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
AS28573 Claro NXT Telecomunicacoes Ltda ASN Active medium 🇧🇷 BR
11 IPs 840 events
ssh:connectiontelnet:connectiontelnet:intrusion
2026-02-18 — 2026-08-10 · 11 IPs from the same network (Claro NXT Telecomunicacoes Ltda, AS28573) were active during overlapping time periods. Temporal …
Session Forensics
scanner ×15 interactive_operator ×4
Sessions
19 (4 with login)
Avg Depth Score
0.31
Commands Executed
70
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Scanner 7e13a0449a8e newark_01 · 2026-10-15 03:07
15%
Loading events...
Scanner 729f21d4c32a newark_01 · 2026-10-15 02:52
15%
Loading events...
Scanner e84ba769d8e6 newark_01 · 2026-10-15 02:37
15%
Loading events...
Scanner 7578e57e3931 newark_01 · 2026-10-15 02:22
15%
Loading events...
Scanner 84cf6a7068a8 newark_01 · 2026-10-15 02:07
15%
Loading events...
Scanner c4f6c97b16e1 newark_01 · 2026-10-15 01:52
15%
Loading events...
Scanner 7c751f6023bb newark_01 · 2026-10-15 01:37
15%
Loading events...
Scanner f6bd65482b56 newark_01 · 2026-10-15 01:22
15%
Loading events...
Scanner a5f440dc3c6a newark_01 · 2026-10-15 01:07
15%
Loading events...
Scanner 9c6d848dc69f newark_01 · 2026-10-15 00:52
15%
Loading events...
Scanner 9c7bac607291 newark_01 · 2026-10-15 00:37
15%
Loading events...
Scanner 4e4a33e327ff newark_01 · 2026-10-15 00:23
15%
Loading events...
Interactive Operator f304b36c690f greencloud_phx_01 · 2026-10-05 15:56
24 1 90%
Loading events...
Interactive Operator 77d8024f735c greencloud_phx_01 · 2026-10-05 15:56
11 1 90%
Loading events...
Interactive Operator 651385b23966 greencloud_phx_01 · 2026-10-05 15:48
24 1 90%
Loading events...
Interactive Operator a828ac05b07c greencloud_phx_01 · 2026-10-05 15:48
11 1 90%
Loading events...
Scanner 7675158985db w4m_seattle_01 · 2026-10-01 20:25
15%
Loading events...
Scanner 5e6974ecc304 w4m_seattle_01 · 2026-10-01 20:10
15%
Loading events...
Scanner b804c3999aa6 w4m_seattle_01 · 2026-10-01 19:55
15%
Loading events...