IntrusionLabs IntrusionLabs
← Back to feed

213.152.161.73

TAGGED MALICIOUS how we decide →
Why: Our sensors observed proxy abuser sessions · certainty: inferred
Threat Confidence
66%
Assessment
  • Opened tunnels through the host in 2 sessions (2 mail relay attempts).
  • Part of a 382-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇳🇱 NL / Haarlem
ASN
AS49453 · Global Layer B.V.
Cloud Provider
—
Total Events
138
Above average by volume
Agent Count
2
First / Last Seen
2026-10-27 02:18 — 2026-10-27 03:31
Attack Types
smtp:relay ssh:connection
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Discovery
T1046
Command and Control
T1090 T1572
External Corroboration
Blocklist.de
Reported 2026-10-27 06:01
blocklist_de:reported
DShield Top Attackers
Reported 2026-10-27 06:01
dshield:top_attacker
Campaigns
Multi-Agent Scan SCAN Active medium
14 IPs 13932 events
2026-10-01 — ongoing · 14 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
382 IPs 1189649 events
2026-09-01 — ongoing · 382 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
350 IPs 1049274 events
2026-05-24 — ongoing · 350 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
355 IPs 1070977 events
2026-04-10 — ongoing · 355 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
320 IPs 881469 events
2026-03-28 — ongoing · 320 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
348 IPs 1101987 events
2026-03-21 — ongoing · 348 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
345 IPs 863664 events
2026-03-02 — ongoing · 345 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×2 proxy_abuser ×2
Sessions
4 (2 with login)
Avg Depth Score
0.5
Commands Executed
0
Files Downloaded
0
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
b539980831525b4f6d85cd0df20988fe
SSH Client
SSH-2.0-9.66 FlowSsh: Bitvise SSH Client (Tunnelier) 9.66 - stnlc
JA4
t12d181100_85036bcba153_cf86beea0419
Evidence Timeline
Proxy Abuser f2c383057bf1 newark_01 · 2026-10-27 03:26
1 85%
Loading events...
Scanner 7fc10cc27261 newark_01 · 2026-10-27 03:26
15%
Loading events...
Proxy Abuser 4f04ab44a6de w4m_singapore_01 · 2026-10-27 02:18
1 85%
Loading events...
Scanner 0f589c971d87 w4m_singapore_01 · 2026-10-27 02:18
15%
Loading events...