← Back to feed

222.213.116.93

93.116.213.222.broad.dy.sc.dynamic.163data.com.cn (163data.com.cn) ✗ FCrDNS

Threat Confidence

42%

Assessment

Port and service scanner

Logged in with 2 different credentials across 2 logins.
Ran 2 commands on the host.
Active for 23 days, 2026-09-24 to 2026-10-18.
Part of a 107-IP campaign from the same network, active in the same window.

Generated from the counts on this page by fixed rules; each line cites the number it rests on.

Location

🇨🇳 CN

ASN

AS4134 · Chinanet

Cloud Provider

—

Total Events

Average by volume

Agent Count

First / Last Seen

2026-09-24 22:43 — 2026-10-18 00:53

Attack Types

ssh:connection ssh:intrusion

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001

Initial Access

T1078

Execution

T1059.004

Discovery

T1016 T1046 T1082

External Corroboration

Blocklist.de

Reported 2026-10-19 05:01

blocklist_de:reported

Campaigns

AS4134 Chinanet ASN Active medium 🇨🇳 CN

107 IPs 12263 events

ftp:bruteforcemysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:connection

2026-02-18 — ongoing · 107 IPs from the same network (Chinanet, AS4134) were active during overlapping time periods. Temporal correlation across a …

Session Forensics

scanner ×4 reconnaissance ×2

Sessions

6 (2 with login)

Avg Depth Score

0.3

Commands Executed

Files Downloaded

Notable Commands

grep -c ^processor /proc/cpuinfo

Fingerprints

1 SSH client banner · 1 HASSH fingerprint

HASSH

1616c6d18e845e7a01168a44591f7a35

SSH Client

SSH-2.0-libssh2_1.9.0

Evidence Timeline

Reconnaissance 2b498e0a86a1 newark_01 · 2026-10-18 00:53

1 1 60%

Loading events...

Reconnaissance 50cf0d04ad12 newark_01 · 2026-10-18 00:53

1 1 60%

Loading events...

Scanner 18e84bf8b976 newark_01 · 2026-10-17 21:57

15%

Loading events...

Scanner 18fc4f5e0061 newark_01 · 2026-10-15 03:39

15%

Loading events...

Scanner a38222cf31db newark_01 · 2026-10-07 13:25

15%

Loading events...

Scanner 7b91b6407e20 newark_01 · 2026-09-24 22:43

15%

Loading events...