IntrusionLabs IntrusionLabs
← Back to feed

71.15.96.217

TAGGED MALICIOUS how we decide →
Why: Our sensors observed interactive operator sessions · certainty: inferred
syn-071-015-096-217.biz.spectrum.com (spectrum.com) ✗ FCrDNS
Threat Confidence
61%
Assessment
Hands-on intruder: runs interactive command sessions
  • Ran 78 commands on the host.
  • Active for 12 days, 2026-09-28 to 2026-10-11.
  • Part of a 258-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US / Fort Worth
ASN
AS20115 · Charter Communications LLC
Cloud Provider
—
Total Events
118
Above average by volume
Agent Count
3
First / Last Seen
2026-09-28 18:17 — 2026-10-11 10:16
Attack Types
telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Execution
T1059.004
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
76 IPs 422425 events
2026-10-10 — ongoing · 76 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
92 IPs 480290 events
2026-10-10 — ongoing · 92 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
189 IPs 690750 events
2026-10-05 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 506396 events
2026-09-30 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
152 IPs 512358 events
2026-09-30 — ongoing · 152 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
50 IPs 171413 events
2026-09-30 — ongoing · 50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
191 IPs 761035 events
2026-09-26 — ongoing · 191 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 604354 events
2026-09-24 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
133 IPs 457796 events
2026-09-24 — ongoing · 133 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
23 IPs 45598 events
2026-09-24 — ongoing · 23 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
192 IPs 530875 events
2026-09-21 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
178 IPs 813730 events
2026-09-21 — ongoing · 178 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 546842 events
2026-09-16 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
209 IPs 906167 events
2026-09-14 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
8 IPs 1337 events
2026-09-14 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
219 IPs 546349 events
2026-09-14 — ongoing · 219 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …
Multi-Agent Scan SCAN Active medium
230 IPs 608673 events
2026-09-14 — ongoing · 230 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
210 IPs 804750 events
2026-09-14 — ongoing · 210 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
66 IPs 44055 events
2026-09-14 — ongoing · 66 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 936655 events
2026-09-14 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
255 IPs 913894 events
2026-09-09 — ongoing · 255 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 879294 events
2026-09-09 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
197 IPs 849478 events
2026-09-09 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
147 IPs 376142 events
2026-06-06 — ongoing · 147 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
258 IPs 916376 events
2026-05-29 — ongoing · 258 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 544537 events
2026-05-29 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
194 IPs 902073 events
2026-05-29 — ongoing · 194 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 433373 events
2026-05-29 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
96 IPs 254780 events
2026-05-29 — ongoing · 96 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
233 IPs 1006448 events
2026-05-29 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
249 IPs 949314 events
2026-05-29 — ongoing · 249 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
224 IPs 995732 events
2026-05-22 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
177 IPs 700766 events
2026-05-19 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
166 IPs 546340 events
2026-04-15 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
251 IPs 628180 events
2026-04-15 — ongoing · 251 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
198 IPs 770176 events
2026-04-05 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
22 IPs 31294 events
2026-03-31 — ongoing · 22 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
13 IPs 9209 events
2026-03-09 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
185 IPs 504073 events
2026-03-09 — ongoing · 185 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
183 IPs 197346 events
2026-03-09 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
238 IPs 595868 events
2026-03-09 — ongoing · 238 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
141 IPs 145485 events
2026-03-06 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
4 IPs 604 events
2026-03-03 — ongoing · 4 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
170 IPs 737062 events
2026-03-03 — ongoing · 170 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
40 IPs 12780 events
2026-03-03 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
253 IPs 1000968 events
2026-03-03 — ongoing · 253 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 1004805 events
2026-03-03 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
242 IPs 955105 events
2026-03-03 — ongoing · 242 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 238385 events
2026-03-03 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
117 IPs 396710 events
2026-03-03 — ongoing · 117 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 889399 events
2026-03-03 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 928166 events
2026-03-01 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
243 IPs 597211 events
2026-03-01 — ongoing · 243 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 663718 events
2026-03-01 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan SCAN Active medium
247 IPs 671435 events
2026-03-01 — ongoing · 247 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
141 IPs 465560 events
2026-03-01 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
231 IPs 649948 events
2026-02-28 — ongoing · 231 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
203 IPs 615055 events
2026-02-27 — ongoing · 203 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
191 IPs 744940 events
2026-02-27 — ongoing · 191 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
109 IPs 433698 events
2026-02-27 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
186 IPs 718787 events
2026-02-27 — ongoing · 186 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
210 IPs 663798 events
2026-02-27 — ongoing · 210 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
215 IPs 723467 events
2026-02-26 — ongoing · 215 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×4 interactive_operator ×5
Sessions
9 (5 with login)
Avg Depth Score
0.57
Commands Executed
78
Files Downloaded
0
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
  • /bin/busybox SORA
Evidence Timeline
Scanner ca92d96dd449 newark_01 · 2026-10-11 10:16
15%
Loading events...
Interactive Operator 129a0498e9a1 greencloud_phx_01 · 2026-10-11 08:07
24 1 90%
Loading events...
Interactive Operator ebcf795ea608 greencloud_phx_01 · 2026-10-11 08:07
11 1 90%
Loading events...
Interactive Operator 6b04b5ec69c7 greencloud_phx_01 · 2026-10-10 22:29
24 1 90%
Loading events...
Interactive Operator 62ec2c530cc8 greencloud_phx_01 · 2026-10-10 22:29
11 1 90%
Loading events...
Scanner 21afc669bd3b newark_01 · 2026-10-09 13:16
15%
Loading events...
Scanner 19811ff12c47 w4m_singapore_01 · 2026-09-29 17:49
15%
Loading events...
Scanner 6df16f2068b6 w4m_singapore_01 · 2026-09-29 17:48
15%
Loading events...
Interactive Operator 8baf9e6414c0 greencloud_phx_01 · 2026-09-28 18:17
8 1 90%
Loading events...