IntrusionLabs IntrusionLabs
← Back to feed

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED

ASN Active medium
Why this campaign was detected
58 IPs from the same network (UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, AS135377) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS135377 · UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
Subnet
—
Country
🇭🇰 HK
Cloud Provider
—
Member Count
58 IPs
Average
Total Events
37609
Average by volume
Started / Ended
2026-02-18 00:26 — ongoing
Attack Types
ftp:bruteforce http:scan mysql:bruteforce ssh:bruteforce ssh:connection ssh:intrusion ssh:malware telnet:bruteforce telnet:connection telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
152.32.225.117 credential_harvester 93% 3x OSINT 280 4 ssh:bruteforcessh:connectionssh:intrusiontelnet:bruteforcetelnet:connectiontelnet:intrusion — 2026-10-18 09:18 evidence →
45.43.37.254 credential_harvester 84% 512 4 ssh:bruteforcessh:intrusiontelnet:bruteforcetelnet:intrusion — 2026-10-19 06:44 evidence →
152.32.218.149 credential_harvester 84% 1x OSINT 3055 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-18 22:30 evidence →
123.58.213.128 credential_harvester 84% 1x OSINT 2285 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-18 20:43 evidence →
123.58.198.35 credential_harvester 78% 1x OSINT 2153 3 ssh:bruteforcessh:intrusionssh:malware — 2026-10-15 23:29 evidence →
118.193.39.103 credential_harvester 78% 1x OSINT 2194 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-15 20:45 evidence →
152.32.212.226 credential_harvester 75% 1x OSINT 1289 3 ssh:bruteforcessh:intrusionssh:malware — 2026-10-14 00:21 evidence →
107.155.48.46 scanner 74% 1x OSINT 48 4 ssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection — 2026-10-19 01:22 evidence →
152.32.182.8 credential_harvester 74% 1x OSINT 2775 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-13 15:23 evidence →
165.154.6.75 credential_harvester 74% 1x OSINT 2265 3 ssh:bruteforcessh:intrusionssh:malware — 2026-10-13 12:08 evidence →
107.150.104.16 credential_harvester 72% 1x OSINT 1357 3 ssh:bruteforcessh:intrusionssh:malware — 2026-10-12 15:56 evidence →
165.154.12.137 scanner 72% 1x OSINT 1073 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-12 13:49 evidence →
152.32.171.213 credential_harvester 71% 1x OSINT 2964 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-12 07:11 evidence →
152.32.174.171 credential_harvester 71% 1x OSINT 253 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-13 08:05 evidence →
128.14.236.30 scanner 68% 2x OSINT 39 3 ftp:bruteforcehttp:scanmysql:bruteforcessh:connection — 2026-10-17 04:33 evidence →
118.193.35.202 scanner 67% 1x OSINT 41 4 ftp:bruteforcehttp:scanmysql:bruteforcessh:connection — 2026-10-18 19:35 evidence →
107.150.123.48 credential_probe 66% 2x OSINT 98 3 ssh:bruteforcessh:intrusiontelnet:bruteforcetelnet:intrusion — 2026-10-17 17:10 evidence →
150.107.36.236 scanner 66% 1x OSINT 153 3 ssh:connectiontelnet:connection — 2026-10-18 12:32 evidence →
152.32.219.77 scanner 65% 1x OSINT 39 4 ftp:bruteforcehttp:scanssh:connectiontelnet:connection — 2026-10-17 14:21 evidence →
107.155.15.218 credential_harvester 64% 1x OSINT 665 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-16 19:30 evidence →
165.154.137.186 credential_harvester 64% 1x OSINT 11145 4 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-13 17:09 evidence →
101.36.125.2 credential_harvester 62% 1x OSINT 452 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-16 07:16 evidence →
152.32.160.252 scanner 61% 1x OSINT 27 3 ftp:bruteforcehttp:scanmysql:bruteforcessh:connection — 2026-10-16 09:50 evidence →
152.32.211.187 credential_harvester 60% 1x OSINT 705 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-14 14:48 evidence →
101.36.105.50 scanner 59% 66 3 ftp:bruteforcehttp:scanmysql:bruteforcessh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection spadenose.com 2026-10-16 07:42 evidence →
104.218.166.62 credential_harvester 58% 743 2 ssh:bruteforcessh:malware — 2026-10-15 20:44 evidence →
128.14.237.43 scanner 57% 1x OSINT 27 3 http:scantelnet:bruteforcetelnet:connection — 2026-10-13 14:27 evidence →
123.58.196.28 scanner 57% 1x OSINT 41 3 ftp:bruteforcemysql:bruteforcessh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection — 2026-10-13 03:31 evidence →
152.32.204.21 scanner 55% 1x OSINT 28 4 http:scanmysql:bruteforcessh:connection — 2026-10-12 18:45 evidence →
152.32.178.47 scanner 54% 1x OSINT 17 3 ftp:bruteforcehttp:scanssh:connection — 2026-10-12 10:22 evidence →
152.32.176.68 scanner 53% 39 3 ftp:bruteforcehttp:scanssh:connection — 2026-10-13 23:52 evidence →
118.194.251.197 credential_harvester 52% 1x OSINT 226 1 ssh:bruteforcessh:malware — 2026-10-16 09:41 evidence →
107.150.117.121 ftp_probe 51% 1x OSINT 6 4 ftp:bruteforcehttp:scanmysql:bruteforce — 2026-10-13 13:22 evidence →
118.26.104.93 scanner 47% 1x OSINT 25 2 mysql:bruteforcessh:connection — 2026-10-17 05:58 evidence →
118.26.38.251 web_probe 47% 1x OSINT 2 2 http:scanmysql:bruteforce — 2026-10-18 11:52 evidence →
104.218.164.192 scanner 46% 1x OSINT 15 2 ftp:bruteforcehttp:scanmysql:bruteforcessh:connection — 2026-10-16 12:54 evidence →
152.32.207.42 scanner 45% 1x OSINT 14 2 ftp:bruteforcemysql:bruteforcessh:connection — 2026-10-16 13:49 evidence →
152.32.213.175 credential_harvester 45% 1x OSINT 208 1 ssh:bruteforcessh:malware — 2026-10-12 10:07 evidence →
101.36.97.70 scanner 44% 14 2 http:scanmysql:bruteforcessh:connection — 2026-10-17 22:26 evidence →
165.154.45.62 credential_probe 41% 33 3 ssh:bruteforcessh:malware — 2026-10-13 22:09 evidence →
152.32.226.138 http:scan 41% 1x OSINT 4 2 http:scantelnet:bruteforce — 2026-10-16 21:02 evidence →
103.211.195.82 credential_harvester 41% 1x OSINT 50 1 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-17 02:05 evidence →
165.154.138.79 scanner 39% 1x OSINT 13 2 http:scanssh:connection mail.shegertravel.com 2026-10-12 19:05 evidence →
152.32.172.234 scanner 39% 13 2 http:scanssh:connection — 2026-10-15 07:15 evidence →
107.150.103.88 web_probe 37% 1x OSINT 2 1 http:scanmysql:bruteforce pbouids.cn 2026-10-18 03:09 evidence →
165.154.163.119 scanner 37% 50 2 ssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection qxkjcy.cn 2026-10-12 20:37 evidence →
118.26.37.105 scanner 36% 1x OSINT 24 2 ssh:connection — 2026-10-16 08:55 evidence →
165.154.29.157 scanner 34% 8 2 ssh:connection — 2026-10-18 20:54 evidence →
45.249.245.55 web_probe 33% 1x OSINT 2 2 http:scan — 2026-10-15 05:11 evidence →
165.154.135.109 web_probe 32% 4 2 http:scan — 2026-10-16 23:30 evidence →
118.26.38.29 scanner 24% 6 1 ssh:connection — 2026-10-18 15:28 evidence →
118.193.69.146 mysql_probe 24% 1x OSINT 3 1 ftp:bruteforcehttp:scanmysql:bruteforce — 2026-10-12 14:30 evidence →
123.58.217.155 scanner 23% 18 1 telnet:bruteforcetelnet:connection — 2026-10-15 15:59 evidence →
152.32.215.224 web_probe 23% 2 1 http:scan — 2026-10-17 06:51 evidence →
118.193.56.229 scanner 21% 1x OSINT 2 1 telnet:connection — 2026-10-14 19:37 evidence →
118.193.33.142 scanner 17% 6 1 ssh:connection — 2026-10-14 18:40 evidence →
165.154.2.143 credential_probe 17% 30 1 ssh:bruteforcessh:connectionssh:intrusion — 2026-10-13 18:16 evidence →
123.58.219.233 scanner 17% 6 1 ssh:connection — 2026-10-14 10:26 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds