← Back to feed

220.90.220.204

TAGGED MALICIOUS how we decide →

Threat Confidence

54%

Location

🇰🇷 KR / Sejong

ASN

AS4766 · Korea Telecom

Cloud Provider

—

Total Events

136

Above average by volume

Agent Count

First / Last Seen

2026-08-09 01:07 — 2026-09-01 02:46

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Initial Access

T1078

Execution

T1059.004

Credential Access

T1110 T1110.001

Discovery

T1016 T1082 T1083

External Corroboration

Blocklist.de

Reported 2026-09-01 10:01

blocklist_de:reported

Campaigns

AS4766 Korea Telecom ASN Active medium 🇰🇷 KR

18 IPs 23406 events

ssh:bruteforce

2026-02-18 — ongoing · 18 IPs from the same network (Korea Telecom, AS4766) were active during overlapping time periods. Temporal correlation across …

Session Forensics

interactive_operator ×4

Sessions

4 (4 with login)

Avg Depth Score

0.9

Commands Executed

Files Downloaded

Notable Commands

/ip cloud print
ifconfig
uname -a
cat /proc/cpuinfo
ps | grep '[Mm]iner'
ps -ef | grep '[Mm]iner'
ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* /dev/ttyUSB-mod* /var/spool/sms/* /var/log/smsd.log /etc/smsd.conf* /usr/bin/qmuxd /var/qmux_connect_socket /etc/config/simman /dev/modem* /var/config/sms/*
locate D877F783D5D3EF8Cs
echo Hi | cat -n

Fingerprints

HASSH

f45fb203c31069bb280067b71ed92ccb

SSH Client

SSH-2.0-libssh2_1.11.1

Evidence Timeline

Interactive Operator 4695120d673b w4m_singapore_01 · 2026-09-01 02:44

10 2 90%

Loading events...

Interactive Operator 178191d6a142 w4m_singapore_01 · 2026-08-26 04:21

10 2 90%

Loading events...

Interactive Operator 16b3b6b316a0 w4m_singapore_01 · 2026-08-24 18:00

10 2 90%

Loading events...

Interactive Operator 7267293c31f0 w4m_singapore_01 · 2026-08-09 01:07

10 2 90%

Loading events...