← Back to feed
216.249.4.20
TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
216.249.4.20.tor.pathcom.com
(pathcom.com)
✓ FCrDNS
Assessment
Hands-on intruder: runs interactive command sessions
- Ran 35 commands on the host.
- Part of a 251-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇨🇦 CA / Mississauga
ASN
AS11342 · Pathway Communications
Cloud Provider
—
Total Events
50
Above average by volume
Agent Count
2
First / Last Seen
2026-10-05 14:49 — 2026-10-06 14:22
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan
SCAN
Active
medium
207 IPs
672905 events
2026-10-04 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
202 IPs
642473 events
2026-09-24 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
171 IPs
675999 events
2026-09-24 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
165 IPs
396523 events
2026-09-16 — ongoing · 165 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
223 IPs
634244 events
2026-09-14 — ongoing · 223 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
167 IPs
449096 events
2026-09-14 — ongoing · 167 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
167 IPs
476651 events
2026-08-23 — ongoing · 167 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
188 IPs
261897 events
2026-08-06 — ongoing · 188 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
162 IPs
548258 events
2026-07-27 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
60 IPs
234569 events
2026-06-24 — ongoing · 60 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
189 IPs
513737 events
2026-05-16 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
112 IPs
119927 events
2026-05-16 — ongoing · 112 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
177 IPs
628041 events
2026-04-13 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
172 IPs
554787 events
2026-04-06 — ongoing · 172 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
106 IPs
252813 events
2026-03-30 — ongoing · 106 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
111 IPs
197935 events
2026-03-26 — ongoing · 111 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
171 IPs
600669 events
2026-03-09 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
145 IPs
284517 events
2026-03-09 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
202 IPs
550850 events
2026-03-08 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
81 IPs
111260 events
2026-03-08 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
251 IPs
718410 events
2026-03-08 — ongoing · 251 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
198 IPs
277835 events
2026-03-08 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
205 IPs
498842 events
2026-03-03 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
163 IPs
544529 events
2026-02-28 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
236 IPs
719808 events
2026-02-27 — ongoing · 236 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
161 IPs
248829 events
2026-02-27 — ongoing · 161 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
148 IPs
188989 events
2026-02-26 — ongoing · 148 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Session Forensics
Sessions
3 (2 with login)
Avg Depth Score
0.65
Commands Executed
35
Files Downloaded
0
Notable Commands
- sh
- shell
- shell
- enable
- enable
- system
- system
- ping; sh
- CMD:
- /bin/busybox HISILICON
Evidence Timeline
Scanner
ce52368843ae
15%
Loading events...
Interactive Operator
f48bc8facbe2
LOGIN
24
1
90%
Loading events...
$ sh$ shell$ shell $ enable$ enable
Interactive Operator
66fe2552232a
LOGIN
11
1
90%
Loading events...
$ sh$ shell$ shell $ enable$ enable