IntrusionLabs IntrusionLabs
← Back to feed

211.253.27.70

Threat Confidence
27%
Assessment
Port and service scanner
  • Logged in with 2 different credentials across 2 logins.
  • Ran 2 commands on the host.
  • Active for 15 days, 2026-09-16 to 2026-10-01.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
37
Above average by volume
Agent Count
1
First / Last Seen
2026-09-16 09:25 — 2026-10-01 22:50
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×5 reconnaissance ×2 credential_probe ×1
Sessions
8 (2 with login)
Avg Depth Score
0.27
Commands Executed
2
Files Downloaded
0
Notable Commands
  • uname -a 2>/dev/null
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
06ff3615a51b2af343ec22abc8e30bbc
SSH Client
SSH-2.0-Go
Evidence Timeline
Reconnaissance c699628077a9 newark_01 · 2026-10-01 22:50
1 1 60%
Loading events...
Scanner a902bd8cc546 newark_01 · 2026-09-22 07:34
15%
Loading events...
Scanner 2425e0f3b789 newark_01 · 2026-09-21 11:36
15%
Loading events...
Scanner 79e5d7f2b331 newark_01 · 2026-09-20 07:42
15%
Loading events...
Scanner 87be985d6415 newark_01 · 2026-09-19 07:59
15%
Loading events...
Scanner 7b0f0d73dd67 newark_01 · 2026-09-19 07:35
15%
Loading events...
Credential Probe e039bdad19aa newark_01 · 2026-09-16 10:16
1 20%
Loading events...
Reconnaissance bb42646f4dea newark_01 · 2026-09-16 09:25
1 1 60%
Loading events...