← Back to feed
AS4134 Chinanet
ASN Active mediumWhy this campaign was detected
110 IPs from the same network (Chinanet, AS4134) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS4134 · Chinanet
Subnet
—
Country
🇨🇳 CN
Cloud Provider
—
Member Count
110 IPs
Above average
Total Events
12289
Below average by volume
Started / Ended
2026-02-18 18:12 — ongoing
Attack Types
MITRE ATT&CK Techniques
Execution
Command and Control
Exfiltration
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 14.29.170.54 | scanner | 82% | 1x OSINT | 320 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-19 07:21 | evidence → |
| 180.100.217.164 | scanner | 81% | 1x OSINT | 220 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-19 05:57 | evidence → |
| 14.29.181.34 | scanner | 81% | 1x OSINT | 599 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-17 22:52 | evidence → |
| 49.64.169.153 | credential_harvester | 80% | 1x OSINT | 1682 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-16 23:27 | evidence → |
| 218.90.138.78 | scanner | 79% | 1x OSINT | 164 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-18 04:43 | evidence → |
| 202.103.55.158 | scanner | 78% | 1x OSINT | 345 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-17 04:50 | evidence → |
| 58.221.60.25 | scanner | 78% | 1x OSINT | 1582 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-16 03:40 | evidence → |
| 49.64.85.138 | scanner | 77% | 1x OSINT | 567 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-16 02:46 | evidence → |
| 121.229.25.10 | scanner | 76% | 1x OSINT | 148 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-16 16:09 | evidence → |
| 121.11.96.13 | scanner | 74% | 1x OSINT | 308 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-14 20:35 | evidence → |
| 114.220.176.69 | scanner | 73% | 1x OSINT | 224 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-14 16:30 | evidence → |
| 14.29.214.161 | credential_harvester | 72% | 1x OSINT | 1369 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-12 16:50 | evidence → |
| 180.108.64.6 | credential_harvester | 72% | 1x OSINT | 406 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-13 08:52 | evidence → |
| 117.62.22.127 | scanner | 72% | 1x OSINT | 426 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-13 07:18 | evidence → |
| 123.180.188.162 | scanner | 70% | 1x OSINT | 34 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-15 22:44 | evidence → |
| 59.36.78.66 | scanner | 67% | 1x OSINT | 409 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-19 00:58 | evidence → |
| 182.149.104.197 | credential_harvester | 66% | 1x OSINT | 399 | 2 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-18 14:21 | evidence → |
| 118.182.166.128 | data_exfiltrator | 65% | 1x OSINT | 26 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-13 19:52 | evidence → |
| 114.220.238.21 | scanner | 65% | 1x OSINT | 22 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-18 00:11 | evidence → |
| 58.222.244.226 | scanner | 62% | 1x OSINT | 810 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-15 16:39 | evidence → |
| 180.101.149.231 | scanner | 60% | 1x OSINT | 43 | 2 | ssh:connectionssh:intrusion | — | 2026-10-18 19:08 | evidence → |
| 14.17.59.195 | scanner | 60% | 1x OSINT | 40 | 2 | ssh:connectionssh:intrusion | — | 2026-10-18 16:42 | evidence → |
| 202.103.157.115 | credential_harvester | 60% | 1x OSINT | 66 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-16 17:18 | evidence → |
| 121.227.152.171 | scanner | 57% | 212 | 2 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-16 13:12 | evidence → | |
| 27.128.240.75 | scanner | 55% | 79 | 2 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-16 14:39 | evidence → | |
| 58.49.26.202 | scanner | 54% | 249 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-14 19:19 | evidence → | |
| 116.52.252.150 | data_exfiltrator | 51% | 1x OSINT | 8 | 2 | ssh:connectionssh:intrusion | 150.252.52.116.broad.km.yn.dynamic.163data.com.cn | 2026-10-14 23:34 | evidence → |
| 59.50.190.203 | malware_dropper | 50% | 66 | 2 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-13 19:46 | evidence → | |
| 220.180.119.22 | scanner | 50% | 1x OSINT | 34 | 2 | ssh:bruteforcessh:connection | — | 2026-10-18 13:51 | evidence → |
| 220.168.118.133 | data_exfiltrator | 47% | 1x OSINT | 16 | 2 | ssh:connectionssh:intrusion | — | 2026-10-12 08:43 | evidence → |
| 123.244.62.87 | scanner | 46% | 1x OSINT | 29 | 1 | ssh:bruteforcessh:connectionssh:malware | 87.62.244.123.broad.tl.ln.dynamic.163data.com.cn | 2026-10-14 21:07 | evidence → |
| 222.213.116.93 | scanner | 41% | 1x OSINT | 24 | 1 | ssh:connectionssh:intrusion | 93.116.213.222.broad.dy.sc.dynamic.163data.com.cn | 2026-10-18 00:53 | evidence → |
| 27.21.91.254 | scanner | 40% | 1x OSINT | 14 | 2 | ssh:connectionssh:intrusion | — | 2026-10-12 19:15 | evidence → |
| 222.223.62.8 | opportunistic_bruter | 36% | 12 | 2 | ssh:bruteforce | 8.62.223.222.broad.cz.he.dynamic.163data.com.cn | 2026-10-14 23:16 | evidence → | |
| 14.29.248.43 | scanner | 33% | 1x OSINT | 33 | 2 | ssh:connection | — | 2026-10-14 08:03 | evidence → |
| 222.186.48.194 | mysql_bruter | 32% | 1x OSINT | 14 | 1 | mysql:bruteforce | — | 2026-10-18 22:04 | evidence → |
| 183.36.254.218 | reconnaissance | 31% | 10 | 1 | ssh:connectionssh:intrusion | — | 2026-10-15 14:52 | evidence → | |
| 106.119.165.24 | reconnaissance | 30% | 10 | 1 | ssh:connectionssh:intrusion | — | 2026-10-15 09:50 | evidence → | |
| 182.149.117.36 | scanner | 28% | 1x OSINT | 8 | 1 | telnet:connection | — | 2026-10-17 20:43 | evidence → |
| 112.66.135.24 | scanner | 26% | 1x OSINT | 2 | 1 | ssh:connection | — | 2026-10-17 23:56 | evidence → |
| 49.81.67.130 | mysql_bruter | 25% | 1x OSINT | 112 | 1 | mysql:bruteforce | — | 2026-10-13 07:36 | evidence → |
| 110.86.161.165 | scanner | 24% | 4 | 1 | telnet:connection | 165.161.86.110.broad.pt.fj.dynamic.163data.com.cn | 2026-10-19 01:04 | evidence → | |
| 183.34.167.196 | ftp_bruter | 24% | 479 | 1 | ftp:bruteforce | — | 2026-10-14 01:29 | evidence → | |
| 183.34.167.209 | ftp_bruter | 24% | 451 | 1 | ftp:bruteforce | — | 2026-10-14 01:29 | evidence → | |
| 180.141.254.254 | scanner | 24% | 2 | 1 | telnet:connection | — | 2026-10-19 06:20 | evidence → | |
| 110.81.121.58 | scanner | 24% | 2 | 1 | telnet:connection | 58.121.81.110.broad.qz.fj.dynamic.163data.com.cn | 2026-10-19 05:24 | evidence → | |
| 113.117.243.132 | scanner | 24% | 2 | 1 | telnet:connection | — | 2026-10-19 02:34 | evidence → | |
| 120.38.202.4 | scanner | 24% | 1x OSINT | 2 | 1 | telnet:connection | 4.202.38.120.broad.np.fj.dynamic.163data.com.cn | 2026-10-16 12:15 | evidence → |
| 202.101.144.44 | scanner | 23% | 1x OSINT | 4 | 1 | ssh:connection | — | 2026-10-15 20:27 | evidence → |
| 171.214.45.4 | scanner | 23% | 5 | 1 | http:scanssh:connection | — | 2026-10-12 08:09 | evidence → | |
| 106.6.216.180 | credential_probe | 23% | 15 | 1 | ssh:bruteforce | — | 2026-10-17 16:42 | evidence → | |
| 111.113.88.214 | scanner | 22% | 4 | 1 | ssh:connection | — | 2026-10-17 17:27 | evidence → | |
| 171.40.10.149 | scanner | 22% | 2 | 1 | telnet:connection | — | 2026-10-18 03:45 | evidence → | |
| 115.235.29.106 | scanner | 22% | 4 | 2 | telnet:connection | — | 2026-10-12 18:50 | evidence → | |
| 124.31.106.255 | scanner | 21% | 2 | 1 | ssh:connection | — | 2026-10-17 17:27 | evidence → | |
| 27.21.26.2 | scanner | 20% | 2 | 1 | telnet:connection | — | 2026-10-17 06:33 | evidence → | |
| 106.58.150.244 | scanner | 20% | 2 | 1 | telnet:connection | — | 2026-10-17 04:22 | evidence → | |
| 112.103.60.28 | scanner | 20% | 2 | 1 | telnet:connection | — | 2026-10-17 04:01 | evidence → | |
| 171.114.226.162 | scanner | 20% | 4 | 1 | telnet:connection | — | 2026-10-16 16:07 | evidence → | |
| 171.112.132.129 | scanner | 20% | 2 | 1 | telnet:connection | — | 2026-10-16 21:59 | evidence → | |
| 183.160.124.157 | scanner | 20% | 18 | 1 | ssh:bruteforcessh:connection | — | 2026-10-14 11:58 | evidence → | |
| 49.86.106.251 | scanner | 19% | 2 | 1 | telnet:connection | — | 2026-10-16 19:37 | evidence → | |
| 27.29.67.154 | scanner | 19% | 2 | 1 | telnet:connection | — | 2026-10-16 19:25 | evidence → | |
| 113.218.223.159 | scanner | 19% | 2 | 1 | telnet:connection | — | 2026-10-16 19:09 | evidence → | |
| 121.235.198.121 | scanner | 19% | 22 | 1 | ssh:connection | — | 2026-10-14 16:57 | evidence → | |
| 106.114.26.148 | scanner | 19% | 2 | 1 | telnet:connection | — | 2026-10-16 10:41 | evidence → | |
| 58.42.19.212 | scanner | 19% | 2 | 1 | telnet:connection | — | 2026-10-16 10:31 | evidence → | |
| 121.228.250.223 | scanner | 19% | 1x OSINT | 2 | 1 | ssh:connection | — | 2026-10-13 18:06 | evidence → |
| 118.248.175.205 | scanner | 18% | 2 | 1 | telnet:connection | — | 2026-10-16 05:23 | evidence → | |
| 42.100.24.2 | scanner | 18% | 2 | 1 | telnet:connection | — | 2026-10-16 02:07 | evidence → | |
| 222.186.170.245 | scanner | 18% | 5 | 1 | ssh:connection | — | 2026-10-15 06:39 | evidence → | |
| 218.70.26.138 | scanner | 18% | 2 | 1 | telnet:connection | — | 2026-10-15 21:33 | evidence → | |
| 118.249.40.234 | scanner | 17% | 2 | 1 | telnet:connection | — | 2026-10-15 16:45 | evidence → | |
| 27.31.110.108 | scanner | 17% | 2 | 1 | telnet:connection | — | 2026-10-15 14:22 | evidence → | |
| 116.208.64.133 | scanner | 17% | 2 | 1 | telnet:connection | — | 2026-10-15 11:00 | evidence → | |
| 112.102.84.150 | scanner | 17% | 2 | 1 | telnet:connection | — | 2026-10-15 07:44 | evidence → | |
| 60.189.49.101 | scanner | 17% | 2 | 1 | telnet:connection | — | 2026-10-15 07:26 | evidence → | |
| 106.59.6.176 | scanner | 17% | 2 | 1 | telnet:connection | — | 2026-10-15 06:52 | evidence → | |
| 125.84.251.111 | scanner | 16% | 2 | 1 | telnet:connection | — | 2026-10-15 05:00 | evidence → | |
| 27.21.28.207 | scanner | 16% | 2 | 1 | telnet:connection | — | 2026-10-15 04:40 | evidence → | |
| 106.32.170.247 | scanner | 16% | 2 | 1 | telnet:connection | — | 2026-10-15 02:35 | evidence → | |
| 121.61.194.108 | scanner | 16% | 2 | 1 | telnet:connection | — | 2026-10-15 01:34 | evidence → | |
| 175.0.68.60 | scanner | 16% | 2 | 1 | telnet:connection | — | 2026-10-15 01:40 | evidence → | |
| 111.173.159.104 | scanner | 16% | 2 | 1 | telnet:connection | — | 2026-10-14 22:46 | evidence → | |
| 171.213.146.65 | scanner | 15% | 2 | 1 | telnet:connection | — | 2026-10-14 14:28 | evidence → | |
| 171.114.227.188 | scanner | 15% | 2 | 1 | telnet:connection | — | 2026-10-14 14:15 | evidence → | |
| 220.190.91.21 | scanner | 15% | 2 | 1 | telnet:connection | — | 2026-10-14 12:58 | evidence → | |
| 111.179.218.5 | scanner | 15% | 6 | 1 | telnet:connection | — | 2026-10-13 16:56 | evidence → | |
| 58.50.192.169 | scanner | 15% | 2 | 1 | telnet:connection | — | 2026-10-14 09:41 | evidence → | |
| 42.100.22.22 | scanner | 15% | 2 | 1 | telnet:connection | — | 2026-10-14 07:45 | evidence → | |
| 112.103.72.23 | scanner | 15% | 2 | 1 | telnet:connection | — | 2026-10-14 07:06 | evidence → | |
| 111.179.223.100 | scanner | 14% | 10 | 1 | telnet:connection | — | 2026-10-12 19:32 | evidence → | |
| 222.209.122.32 | scanner | 14% | 4 | 1 | telnet:connection | 32.122.209.222.broad.cd.sc.dynamic.163data.com.cn | 2026-10-13 11:27 | evidence → | |
| 222.79.179.23 | scanner | 14% | 4 | 1 | telnet:connection | 23.179.79.222.broad.qz.fj.dynamic.163data.com.cn | 2026-10-13 09:52 | evidence → | |
| 106.40.80.189 | scanner | 14% | 2 | 1 | telnet:connection | — | 2026-10-13 21:03 | evidence → | |
| 113.221.46.167 | scanner | 14% | 2 | 1 | telnet:connection | — | 2026-10-13 18:34 | evidence → | |
| 222.208.24.3 | scanner | 14% | 5 | 1 | telnet:bruteforcetelnet:connection | 3.24.208.222.broad.nc.sc.dynamic.163data.com.cn | 2026-10-12 08:56 | evidence → | |
| 27.22.67.192 | scanner | 14% | 2 | 1 | telnet:connection | — | 2026-10-13 15:32 | evidence → | |
| 175.9.136.144 | scanner | 13% | 2 | 1 | telnet:connection | — | 2026-10-13 11:58 | evidence → | |
| 1.83.221.71 | scanner | 13% | 2 | 1 | ssh:connection | — | 2026-10-13 09:18 | evidence → | |
| 171.114.227.217 | scanner | 13% | 2 | 1 | telnet:connection | — | 2026-10-13 09:10 | evidence → | |
| 106.40.240.119 | scanner | 13% | 2 | 1 | telnet:connection | — | 2026-10-13 04:50 | evidence → | |
| 114.138.103.217 | scanner | 13% | 2 | 1 | telnet:connection | — | 2026-10-13 02:25 | evidence → | |
| 113.221.79.133 | scanner | 12% | 2 | 1 | telnet:connection | — | 2026-10-13 01:33 | evidence → | |
| 171.83.147.126 | scanner | 12% | 2 | 1 | telnet:connection | — | 2026-10-12 21:23 | evidence → | |
| 223.151.76.117 | scanner | 12% | 2 | 1 | telnet:connection | — | 2026-10-12 21:08 | evidence → | |
| 182.245.227.167 | scanner | 12% | 2 | 1 | telnet:connection | — | 2026-10-12 19:42 | evidence → | |
| 123.245.66.28 | scanner | 12% | 2 | 1 | telnet:connection | — | 2026-10-12 18:01 | evidence → | |
| 121.61.51.105 | scanner | 11% | 2 | 1 | telnet:connection | — | 2026-10-12 12:23 | evidence → | |
| 175.9.216.25 | scanner | 11% | 2 | 1 | telnet:connection | — | 2026-10-12 10:22 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds