IntrusionLabs IntrusionLabs
← Back to feed

221.160.202.13

Threat Confidence
36%
Assessment
Port and service scanner
  • Active for 26 days, 2026-09-29 to 2026-10-25.
  • Part of a 387-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR / Asan
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
14
Average by volume
Agent Count
2
First / Last Seen
2026-09-29 05:30 — 2026-10-25 19:17
Attack Types
telnet:connection
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
19 IPs 108448 events
2026-09-29 — ongoing · 19 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
88 IPs 78433 events
2026-09-01 — ongoing · 88 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
387 IPs 1095898 events
2026-07-28 — ongoing · 387 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
196 IPs 636214 events
2026-05-13 — ongoing · 196 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan SCAN Active medium
273 IPs 906011 events
2026-03-11 — ongoing · 273 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
108 IPs 92968 events
2026-03-05 — ongoing · 108 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
276 IPs 815882 events
2026-03-01 — ongoing · 276 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
363 IPs 1131316 events
2026-03-01 — ongoing · 363 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
360 IPs 1081385 events
2026-03-01 — ongoing · 360 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
266 IPs 641914 events
2026-02-26 — ongoing · 266 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS4766 Korea Telecom ASN Active medium 🇰🇷 KR
224 IPs 157079 events
ssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:credential-reusetelnet:intrusiontelnet:malware
2026-02-18 — ongoing · 224 IPs from the same network (Korea Telecom, AS4766) were active during overlapping time periods. Temporal correlation across …
Session Forensics
scanner ×7
Sessions
7
Avg Depth Score
0.15
Commands Executed
0
Files Downloaded
0
Evidence Timeline
Scanner 26c02e2f6ff5 w4m_seattle_01 · 2026-10-25 19:17
15%
Loading events...
Scanner 5cf476fa881d w4m_seattle_01 · 2026-10-25 18:47
15%
Loading events...
Scanner 07d6adc99e45 w4m_seattle_01 · 2026-10-25 18:17
15%
Loading events...
Scanner 3f70ad16ebec w4m_seattle_01 · 2026-10-25 17:49
15%
Loading events...
Scanner f84dfd203fd9 newark_01 · 2026-10-20 18:24
15%
Loading events...
Scanner 84a3816f7b98 newark_01 · 2026-10-20 16:39
15%
Loading events...
Scanner 48fb6341a0d1 w4m_seattle_01 · 2026-09-29 05:30
15%
Loading events...