IntrusionLabs IntrusionLabs
← Back to feed

AS4811 China Telecom (Group)

ASN Active medium
Why this campaign was detected
24 IPs from the same network (China Telecom (Group), AS4811) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS4811 · China Telecom (Group)
Subnet
—
Country
🇨🇳 CN
Cloud Provider
—
Member Count
24 IPs
Below average
Total Events
2645
Below average by volume
Started / Ended
2026-02-16 20:33 — ongoing
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion ssh:malware telnet:bruteforce telnet:connection
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
14.103.83.214 credential_harvester 80% 1x OSINT 353 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-18 02:56 evidence →
118.196.118.181 scanner 80% 1x OSINT 122 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-19 00:58 evidence →
14.103.48.24 credential_harvester 80% 1x OSINT 172 3 ssh:bruteforcessh:malware — 2026-10-18 12:41 evidence →
14.103.103.211 credential_harvester 74% 248 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-17 11:34 evidence →
14.103.115.253 scanner 73% 1x OSINT 197 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-14 15:54 evidence →
14.103.116.87 scanner 64% 1x OSINT 247 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-17 21:03 evidence →
101.89.148.7 scanner 63% 49 3 ssh:connectionssh:intrusion — 2026-10-18 11:15 evidence →
14.103.50.32 scanner 62% 1x OSINT 173 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-16 19:16 evidence →
114.80.32.225 scanner 61% 1x OSINT 68 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-17 14:49 evidence →
101.227.203.162 scanner 58% 160 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-17 09:07 evidence →
180.184.182.87 scanner 57% 1x OSINT 271 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-14 04:29 evidence →
14.103.86.48 scanner 57% 210 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-16 23:10 evidence →
180.184.141.117 scanner 57% 79 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-17 11:30 evidence →
118.196.86.3 scanner 55% 1x OSINT 88 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-13 17:00 evidence →
14.103.29.165 credential_probe 51% 1x OSINT 40 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-16 11:28 evidence →
118.196.122.122 credential_probe 49% 2x OSINT 7 2 ssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection — 2026-10-18 23:54 evidence →
203.156.216.10 scanner 37% 24 1 ssh:connectionssh:intrusion — 2026-10-18 03:25 evidence →
14.103.119.118 scanner 36% 1x OSINT 23 2 ssh:bruteforcessh:connection — 2026-10-15 20:15 evidence →
14.103.117.88 scanner 32% 1x OSINT 45 1 ssh:bruteforcessh:connection — 2026-10-17 15:24 evidence →
14.103.105.62 scanner 26% 1x OSINT 10 1 ssh:connection — 2026-10-16 09:21 evidence →
14.103.87.77 scanner 26% 6 2 ssh:connection — 2026-10-14 10:59 evidence →
14.103.117.85 scanner 25% 17 2 ssh:connection — 2026-10-13 06:55 evidence →
14.103.213.90 scanner 24% 32 1 ssh:bruteforcessh:connection — 2026-10-16 10:07 evidence →
180.163.67.45 scanner 13% 4 1 ssh:connection — 2026-10-12 22:17 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds