← Back to feed
AS31898 Oracle Corporation
ASN Active mediumWhy this campaign was detected
39 IPs from the same network (Oracle Corporation, AS31898) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS31898 · Oracle Corporation
Subnet
—
Country
🇺🇸 US
Cloud Provider
—
Member Count
39 IPs
Below average
Total Events
32592
Average by volume
Started / Ended
2026-02-18 00:41 — ongoing
Attack Types
MITRE ATT&CK Techniques
Execution
Command and Control
Exfiltration
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 136.248.121.226 | credential_harvester | 84% | 1x OSINT | 3308 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-19 08:19 | evidence → |
| 69.6.234.27 | credential_harvester | 84% | 1x OSINT | 1738 | 3 | ssh:bruteforcessh:connectionssh:malware | 69-6-234-27.unifiedlayer.com | 2026-10-19 05:25 | evidence → |
| 164.152.250.192 | credential_harvester | 84% | 1x OSINT | 1853 | 4 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-18 22:39 | evidence → |
| 129.121.123.80 | credential_harvester | 83% | 1x OSINT | 1511 | 3 | ssh:bruteforcessh:connectionssh:malware | 129-121-123-80.unifiedlayer.com | 2026-10-18 16:20 | evidence → |
| 158.178.141.16 | credential_harvester | 83% | 1x OSINT | 3878 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-18 14:56 | evidence → |
| 129.121.74.52 | credential_harvester | 82% | 1x OSINT | 809 | 3 | ssh:bruteforcessh:malware | 129-121-74-52.unifiedlayer.com | 2026-10-18 13:40 | evidence → |
| 150.136.104.48 | credential_harvester | 82% | 1x OSINT | 362 | 3 | ssh:bruteforcessh:malware | — | 2026-10-19 04:09 | evidence → |
| 129.121.111.123 | credential_harvester | 79% | 1x OSINT | 290 | 3 | ssh:bruteforcessh:connectionssh:malware | sqi.wqk.mybluehost.me | 2026-10-17 21:08 | evidence → |
| 129.121.94.183 | credential_harvester | 79% | 1x OSINT | 660 | 3 | ssh:bruteforcessh:malware | lrj.xfu.mybluehost.me | 2026-10-16 23:53 | evidence → |
| 108.174.147.36 | credential_harvester | 78% | 1x OSINT | 1484 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | 108-174-147-36.unifiedlayer.com | 2026-10-16 01:05 | evidence → |
| 129.121.75.215 | credential_harvester | 78% | 1x OSINT | 1031 | 3 | ssh:bruteforcessh:malware | 129-121-75-215.unifiedlayer.com | 2026-10-15 23:59 | evidence → |
| 159.112.138.47 | credential_harvester | 78% | 1x OSINT | 4253 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-15 16:36 | evidence → |
| 136.248.242.166 | credential_harvester | 76% | 1x OSINT | 1964 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-14 17:21 | evidence → |
| 129.121.114.113 | credential_harvester | 74% | 1x OSINT | 939 | 3 | ssh:bruteforcessh:connectionssh:malware | 129-121-114-113.unifiedlayer.com | 2026-10-13 19:07 | evidence → |
| 66.116.224.33 | credential_harvester | 68% | 1x OSINT | 705 | 2 | ssh:bruteforcessh:connectionssh:malware | server.girhoney.com | 2026-10-18 20:55 | evidence → |
| 129.121.142.157 | credential_harvester | 67% | 1x OSINT | 547 | 2 | ssh:bruteforcessh:connectionssh:malware | 129-121-142-157.unifiedlayer.com | 2026-10-18 15:24 | evidence → |
| 129.121.97.74 | credential_harvester | 65% | 1x OSINT | 318 | 2 | ssh:bruteforcessh:malware | server.thu.fhr.mybluehost.me | 2026-10-17 21:18 | evidence → |
| 129.121.141.3 | credential_harvester | 64% | 1x OSINT | 213 | 2 | ssh:bruteforcessh:malware | 129-121-141-3.unifiedlayer.com | 2026-10-17 21:48 | evidence → |
| 129.121.115.165 | credential_harvester | 64% | 1x OSINT | 236 | 2 | ssh:bruteforcessh:malware | 129-121-115-165.unifiedlayer.com | 2026-10-17 16:27 | evidence → |
| 138.2.92.229 | credential_harvester | 63% | 1x OSINT | 768 | 2 | ssh:bruteforcessh:malware | — | 2026-10-16 08:37 | evidence → |
| 129.121.101.179 | opportunistic_bruter | 63% | 1x OSINT | 46 | 2 | ssh:bruteforcessh:malware | 129-121-101-179.unifiedlayer.com | 2026-10-18 17:34 | evidence → |
| 66.116.241.89 | credential_harvester | 63% | 1x OSINT | 1800 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | profile-hub.in | 2026-10-15 18:25 | evidence → |
| 129.121.142.210 | credential_harvester | 62% | 1x OSINT | 614 | 2 | ssh:bruteforcessh:malware | 129-121-142-210.unifiedlayer.com | 2026-10-15 21:12 | evidence → |
| 50.6.249.246 | opportunistic_bruter | 61% | 1x OSINT | 46 | 2 | ssh:bruteforcessh:malware | 50-6-249-246.unifiedlayer.com | 2026-10-17 18:26 | evidence → |
| 129.121.136.31 | malware_dropper | 58% | 1x OSINT | 46 | 2 | ssh:bruteforcessh:malware | 129-121-136-31.unifiedlayer.com | 2026-10-15 20:44 | evidence → |
| 129.213.151.234 | web_probe | 57% | 2x OSINT | 9 | 4 | http:scan | — | 2026-10-17 05:36 | evidence → |
| 129.121.100.53 | credential_harvester | 56% | 1x OSINT | 285 | 1 | ssh:bruteforcessh:malware | 129-121-100-53.unifiedlayer.com | 2026-10-18 11:13 | evidence → |
| 150.136.227.229 | data_exfiltrator | 55% | 1x OSINT | 36 | 2 | ssh:intrusion | — | 2026-10-16 03:08 | evidence → |
| 129.121.78.222 | credential_harvester | 53% | 1x OSINT | 280 | 1 | ssh:bruteforcessh:connectionssh:malware | 129-121-78-222.unifiedlayer.com | 2026-10-16 20:24 | evidence → |
| 129.121.112.42 | credential_harvester | 53% | 1x OSINT | 316 | 1 | ssh:bruteforcessh:malware | 129-121-112-42.unifiedlayer.com | 2026-10-16 17:18 | evidence → |
| 129.121.137.135 | credential_harvester | 53% | 1x OSINT | 285 | 1 | ssh:bruteforcessh:malware | 129-121-137-135.unifiedlayer.com | 2026-10-16 18:46 | evidence → |
| 144.24.86.234 | credential_harvester | 51% | 774 | 2 | telnet:bruteforce | — | 2026-10-19 01:19 | evidence → | |
| 66.116.253.148 | malware_dropper | 49% | 1x OSINT | 23 | 1 | ssh:bruteforcessh:malware | mylittlesole.info | 2026-10-16 23:48 | evidence → |
| 129.121.136.201 | malware_dropper | 48% | 1x OSINT | 23 | 1 | ssh:bruteforcessh:malware | 129-121-136-201.unifiedlayer.com | 2026-10-16 09:05 | evidence → |
| 129.121.139.209 | opportunistic_bruter | 40% | 23 | 1 | ssh:bruteforcessh:malware | 129-121-139-209.unifiedlayer.com | 2026-10-14 16:30 | evidence → | |
| 137.23.28.31 | credential_harvester | 33% | 1x OSINT | 74 | 1 | ssh:bruteforcessh:connection | — | 2026-10-17 20:02 | evidence → |
| 155.248.194.132 | reconnaissance | 26% | 10 | 1 | ssh:connectionssh:intrusion | — | 2026-10-13 04:33 | evidence → | |
| 161.118.237.87 | web_probe | 23% | 2 | 2 | http:scan | — | 2026-10-12 11:00 | evidence → | |
| 140.245.124.77 | scanner | 21% | 1056 | 1 | ssh:connection | — | 2026-10-12 10:46 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds