IntrusionLabs IntrusionLabs
← Back to feed

2.157.242.254

Threat Confidence
59%
Assessment
Port and service scanner
  • Ran 105 commands on the host.
  • Part of a 209-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇮🇹 IT / San Gimignano
ASN
AS1267 · Wind Tre S.p.A.
Cloud Provider
—
Total Events
170
Above average by volume
Agent Count
2
First / Last Seen
2026-10-20 03:49 — 2026-10-21 07:45
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
17 IPs 3406 events
2026-09-29 — ongoing · 17 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
67 IPs 142767 events
2026-09-09 — ongoing · 67 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
184 IPs 719238 events
2026-04-15 — ongoing · 184 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
209 IPs 673622 events
2026-03-16 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
129 IPs 664978 events
2026-02-26 — ongoing · 129 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
174 IPs 739091 events
2026-02-26 — ongoing · 174 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
195 IPs 689506 events
2026-02-26 — ongoing · 195 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×13 interactive_operator ×6
Sessions
19 (6 with login)
Avg Depth Score
0.39
Commands Executed
105
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Evidence Timeline
Scanner f63cb5ebf318 w4m_singapore_01 · 2026-10-21 07:43
15%
Loading events...
Scanner cf808662f4a1 w4m_singapore_01 · 2026-10-21 07:28
15%
Loading events...
Scanner 2609fa97040d w4m_singapore_01 · 2026-10-21 07:13
15%
Loading events...
Scanner b768585081f5 w4m_singapore_01 · 2026-10-21 07:13
15%
Loading events...
Scanner 1f2db2bcb761 w4m_singapore_01 · 2026-10-21 07:13
15%
Loading events...
Scanner 882c6e643428 w4m_singapore_01 · 2026-10-21 06:43
15%
Loading events...
Scanner 4628229a0d58 w4m_singapore_01 · 2026-10-21 06:43
15%
Loading events...
Scanner 241918883057 w4m_singapore_01 · 2026-10-21 06:43
15%
Loading events...
Scanner 08d75d5f6f88 w4m_singapore_01 · 2026-10-21 05:58
15%
Loading events...
Scanner e6aea6b4e065 w4m_singapore_01 · 2026-10-21 05:58
15%
Loading events...
Scanner 0fe8e2c3b188 w4m_singapore_01 · 2026-10-21 05:58
15%
Loading events...
Scanner 46e9192db917 w4m_singapore_01 · 2026-10-21 05:42
15%
Loading events...
Scanner 5e6b3b1ea291 w4m_singapore_01 · 2026-10-21 05:28
15%
Loading events...
Interactive Operator 68002955ab3a greencloud_phx_01 · 2026-10-20 03:49
24 1 90%
Loading events...
Interactive Operator 831d99b76349 greencloud_phx_01 · 2026-10-20 03:49
24 1 90%
Loading events...
Interactive Operator 1b7b929d6858 greencloud_phx_01 · 2026-10-20 03:49
24 1 90%
Loading events...
Interactive Operator dda2558760e1 greencloud_phx_01 · 2026-10-20 03:49
11 1 90%
Loading events...
Interactive Operator de834eb562ed greencloud_phx_01 · 2026-10-20 03:49
11 1 90%
Loading events...
Interactive Operator 154f920f2c85 greencloud_phx_01 · 2026-10-20 03:49
11 1 90%
Loading events...