IntrusionLabs IntrusionLabs
← Back to feed

AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.

ASN Active medium
Why this campaign was detected
26 IPs from the same network (Beijing Baidu Netcom Science and Technology Co., Ltd., AS38365) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS38365 · Beijing Baidu Netcom Science and Technology Co., Ltd.
Subnet
—
Country
🇨🇳 CN
Cloud Provider
—
Member Count
26 IPs
Below average
Total Events
4506
Below average by volume
Started / Ended
2026-02-18 13:36 — ongoing
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion ssh:malware telnet:bruteforce telnet:connection
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
120.48.90.166 scanner 80% 1x OSINT 300 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-18 06:57 evidence →
106.12.177.73 scanner 80% 1x OSINT 579 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-17 14:12 evidence →
106.13.48.117 scanner 79% 1x OSINT 1053 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-16 14:34 evidence →
106.12.128.184 credential_harvester 78% 1x OSINT 166 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-17 16:22 evidence →
180.76.137.24 scanner 77% 1x OSINT 140 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-17 08:20 evidence →
106.13.107.71 data_exfiltrator 73% 1x OSINT 20 3 ssh:connectionssh:intrusion — 2026-10-18 06:20 evidence →
106.12.182.44 opportunistic_bruter 71% 41 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-17 13:21 evidence →
180.76.233.159 scanner 65% 1x OSINT 52 3 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-17 04:05 evidence →
106.12.220.4 scanner 65% 1x OSINT 30 3 ssh:connectionssh:intrusion — 2026-10-17 13:11 evidence →
106.12.74.119 scanner 63% 1x OSINT 181 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-17 08:25 evidence →
106.12.86.201 scanner 59% 1x OSINT 130 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-15 13:37 evidence →
120.48.44.93 credential_harvester 58% 1x OSINT 743 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-13 18:03 evidence →
106.13.228.234 scanner 57% 1x OSINT 547 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-13 04:21 evidence →
106.13.234.209 credential_harvester 56% 1x OSINT 94 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-14 11:42 evidence →
120.48.176.104 reconnaissance 54% 1x OSINT 77 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-13 17:35 evidence →
180.76.57.66 scanner 51% 1x OSINT 10 2 ssh:connectionssh:intrusion — 2026-10-14 23:34 evidence →
180.76.232.26 credential_harvester 50% 1x OSINT 121 1 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-15 18:24 evidence →
106.12.120.171 data_exfiltrator 50% 1x OSINT 17 2 ssh:connectionssh:intrusion — 2026-10-13 22:17 evidence →
180.76.234.73 scanner 48% 14 3 ssh:connection — 2026-10-18 00:31 evidence →
106.13.124.251 credential_probe 47% 1x OSINT 35 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-14 16:29 evidence →
120.48.144.5 scanner 44% 13 2 ssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection — 2026-10-18 12:34 evidence →
180.76.97.104 scanner 43% 1x OSINT 49 2 ssh:bruteforcessh:connection — 2026-10-14 15:09 evidence →
120.48.106.235 scanner 40% 1x OSINT 23 2 ssh:bruteforcessh:connection — 2026-10-18 00:00 evidence →
180.76.250.204 scanner 34% 15 1 ssh:connectionssh:intrusion — 2026-10-17 04:30 evidence →
180.76.135.219 credential_harvester 30% 1x OSINT 46 1 ssh:bruteforcessh:connection — 2026-10-16 18:13 evidence →
120.48.41.103 reconnaissance 28% 10 1 ssh:connectionssh:intrusion — 2026-10-14 02:27 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds