IntrusionLabs IntrusionLabs
← Back to feed

212.64.173.100

innovier.lpa.idec.net (idec.net) ✓ FCrDNS
Threat Confidence
76%
Assessment
Port and service scanner
  • Downloaded 4 files and ran 56 commands on the host.
  • Active for 20 days, 2026-10-09 to 2026-10-30.
  • Part of a 268-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇪🇸 ES / Las Palmas de Gran Canaria
ASN
AS12540 · IdecNet S.A.
Cloud Provider
—
Total Events
112
Above average by volume
Agent Count
3
First / Last Seen
2026-10-09 13:27 — 2026-10-30 03:49
Attack Types
telnet:connection telnet:intrusion telnet:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
92 IPs 548720 events
2026-08-29 — ongoing · 92 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
189 IPs 559691 events
2026-05-17 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 737595 events
2026-03-04 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 467918 events
2026-03-03 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
127 IPs 203567 events
2026-03-03 — ongoing · 127 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
268 IPs 1030208 events
2026-02-28 — ongoing · 268 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
108 IPs 80029 events
2026-02-27 — ongoing · 108 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×9 malware_dropper ×2 interactive_operator ×2
Sessions
13 (4 with login)
Avg Depth Score
0.4
Commands Executed
56
Files Downloaded
4
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Download URLs
  • http://130.12.180.212/x86_64
Evidence Timeline
Scanner 18503f8ce9bc newark_01 · 2026-10-30 03:49
15%
Loading events...
Scanner bd3f75af4871 newark_01 · 2026-10-30 03:34
15%
Loading events...
Scanner 5b50dae27742 newark_01 · 2026-10-30 03:19
15%
Loading events...
Scanner 2c9ab1f51c40 w4m_seattle_01 · 2026-10-30 00:38
15%
Loading events...
Scanner a65fc18b31f7 w4m_seattle_01 · 2026-10-30 00:23
15%
Loading events...
Scanner e6ee83ddb283 w4m_seattle_01 · 2026-10-30 00:08
15%
Loading events...
Scanner 666dc34c5fa2 w4m_seattle_01 · 2026-10-29 23:51
15%
Loading events...
Scanner 1405a104cb5e w4m_seattle_01 · 2026-10-29 23:37
15%
Loading events...
Scanner 6374989eac4a w4m_seattle_01 · 2026-10-29 23:22
15%
Loading events...
Malware Dropper 275c1b00ada1 greencloud_phx_01 · 2026-10-09 14:27
17 2 1 100%
Loading events...
Interactive Operator 6e4eae120e41 greencloud_phx_01 · 2026-10-09 14:27
11 1 90%
Loading events...
Malware Dropper 4341d278d481 greencloud_phx_01 · 2026-10-09 13:27
17 2 1 100%
Loading events...
Interactive Operator 54b1d01114ba greencloud_phx_01 · 2026-10-09 13:27
11 1 90%
Loading events...