IntrusionLabs IntrusionLabs
← Back to feed

AS4837 CHINA UNICOM China169 Backbone

ASN Active medium
Why this campaign was detected
70 IPs from the same network (CHINA UNICOM China169 Backbone, AS4837) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS4837 · CHINA UNICOM China169 Backbone
Subnet
—
Country
🇨🇳 CN
Cloud Provider
—
Member Count
70 IPs
Average
Total Events
2558
Below average by volume
Started / Ended
2026-02-16 18:41 — ongoing
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion ssh:malware telnet:connection
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
112.123.228.180 credential_harvester 77% 1x OSINT 175 3 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-17 04:14 evidence →
183.94.33.245 scanner 76% 1x OSINT 179 3 ssh:bruteforcessh:connectionssh:malware — 2026-10-16 07:11 evidence →
125.39.148.106 scanner 67% 1x OSINT 66 3 ssh:bruteforcessh:connectionssh:intrusion no-data 2026-10-13 19:20 evidence →
61.240.156.16 scanner 62% 1x OSINT 467 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-16 09:09 evidence →
218.27.202.178 scanner 62% 1x OSINT 27 3 ssh:connectionssh:intrusion 178.202.27.218.adsl-pool.jlccptt.net.cn 2026-10-16 04:50 evidence →
122.114.69.235 scanner 59% 1x OSINT 71 2 ssh:connectionssh:intrusionssh:malware — 2026-10-16 06:49 evidence →
221.195.232.14 scanner 50% 24 3 ssh:connection — 2026-10-18 13:14 evidence →
175.161.222.15 malware_dropper 48% 1x OSINT 23 1 ssh:bruteforcessh:malware — 2026-10-15 23:38 evidence →
121.29.4.88 reconnaissance 44% 20 2 ssh:connectionssh:intrusion — 2026-10-17 06:21 evidence →
123.129.219.195 scanner 40% 1x OSINT 9 2 ssh:bruteforcessh:connection — 2026-10-18 13:18 evidence →
101.66.165.103 scanner 37% 1x OSINT 26 2 ssh:connection — 2026-10-16 23:10 evidence →
42.57.181.170 scanner 33% 1x OSINT 50 1 telnet:connection — 2026-10-18 14:46 evidence →
218.21.182.228 scanner 31% 12 2 telnet:connection — 2026-10-16 22:35 evidence →
119.179.239.112 scanner 31% 1x OSINT 48 1 telnet:connection — 2026-10-17 14:00 evidence →
112.194.141.59 scanner 28% 1x OSINT 4 1 ssh:connection — 2026-10-18 14:47 evidence →
119.182.137.244 scanner 28% 4 2 telnet:connection — 2026-10-15 23:06 evidence →
115.57.184.144 scanner 27% 46 1 telnet:connection hn.kd.ny.adsl 2026-10-18 04:16 evidence →
120.8.212.216 scanner 26% 26 1 telnet:connection — 2026-10-18 03:25 evidence →
115.63.51.32 scanner 25% 16 1 telnet:connection hn.kd.ny.adsl 2026-10-18 07:47 evidence →
222.138.135.100 scanner 25% 50 1 telnet:connection hn.kd.ny.adsl 2026-10-17 03:58 evidence →
175.165.81.27 scanner 24% 118 1 telnet:connection — 2026-10-15 23:47 evidence →
115.59.20.125 scanner 24% 48 1 telnet:connection hn.kd.ny.adsl 2026-10-16 19:18 evidence →
222.137.145.255 scanner 24% 14 1 telnet:connection hn.kd.ny.adsl 2026-10-17 17:14 evidence →
123.190.235.216 scanner 24% 60 1 telnet:connection — 2026-10-16 04:28 evidence →
115.55.9.131 scanner 23% 48 1 telnet:connection hn.kd.ny.adsl 2026-10-16 07:22 evidence →
220.202.67.114 scanner 23% 38 1 telnet:connection — 2026-10-16 06:50 evidence →
175.43.87.168 scanner 23% 4 1 telnet:connection — 2026-10-18 04:55 evidence →
222.137.85.203 scanner 23% 50 1 telnet:connection hn.kd.ny.adsl 2026-10-15 20:44 evidence →
116.139.178.34 scanner 22% 192 1 telnet:connection — 2026-10-14 10:29 evidence →
122.97.212.140 scanner 22% 2 1 telnet:connection — 2026-10-18 03:33 evidence →
122.96.31.92 scanner 22% 2 1 telnet:connection — 2026-10-18 03:34 evidence →
116.138.108.104 scanner 22% 80 1 telnet:connection — 2026-10-14 22:54 evidence →
116.139.202.60 scanner 21% 2 1 telnet:connection — 2026-10-17 15:41 evidence →
42.233.89.140 scanner 21% 50 1 telnet:connection hn.kd.ny.adsl 2026-10-14 23:33 evidence →
36.32.194.214 scanner 21% 2 1 telnet:connection — 2026-10-17 14:58 evidence →
123.9.108.246 scanner 21% 48 1 telnet:connection hn.kd.ny.adsl 2026-10-15 00:02 evidence →
116.162.216.80 scanner 21% 1x OSINT 4 1 ssh:connection — 2026-10-14 12:00 evidence →
1.24.16.47 scanner 21% 4 1 ssh:connection — 2026-10-17 00:38 evidence →
61.52.79.81 scanner 21% 24 1 telnet:connection hn.kd.dhcp 2026-10-15 10:02 evidence →
42.224.66.68 scanner 20% 14 1 telnet:connection hn.kd.ny.adsl 2026-10-15 20:02 evidence →
27.219.135.181 credential_probe 20% 9 1 ssh:bruteforcessh:connection — 2026-10-16 19:19 evidence →
115.60.156.68 scanner 20% 2 1 telnet:connection hn.kd.ny.adsl 2026-10-17 04:48 evidence →
122.96.28.138 scanner 20% 2 1 ssh:connection — 2026-10-17 00:38 evidence →
42.234.51.25 scanner 20% 14 1 telnet:connection hn.kd.ny.adsl 2026-10-15 08:53 evidence →
123.139.198.240 scanner 19% 2 1 telnet:connection — 2026-10-16 16:20 evidence →
42.224.84.238 scanner 19% 50 1 telnet:connection hn.kd.ny.adsl 2026-10-13 20:29 evidence →
122.96.50.118 scanner 19% 30 1 telnet:connection — 2026-10-14 05:28 evidence →
125.40.44.167 scanner 19% 50 1 telnet:connection hn.kd.ny.adsl 2026-10-13 15:45 evidence →
123.8.16.193 scanner 18% 48 1 telnet:connection hn.kd.ny.adsl 2026-10-13 11:56 evidence →
122.97.137.29 scanner 18% 20 1 telnet:connection — 2026-10-14 05:28 evidence →
42.231.40.112 scanner 17% 36 1 telnet:connection hn.kd.ny.adsl 2026-10-13 08:41 evidence →
61.176.70.250 scanner 17% 16 1 telnet:connection — 2026-10-14 01:38 evidence →
222.141.3.235 scanner 17% 2 1 telnet:connection hn.kd.ny.adsl 2026-10-15 16:08 evidence →
60.23.237.219 scanner 17% 44 1 telnet:connection — 2026-10-13 00:35 evidence →
39.67.194.108 scanner 17% 2 1 telnet:connection — 2026-10-15 11:27 evidence →
122.96.48.122 scanner 17% 2 1 telnet:connection — 2026-10-15 08:35 evidence →
43.248.108.242 scanner 16% 2 1 telnet:connection — 2026-10-15 05:01 evidence →
122.96.31.19 scanner 16% 2 1 telnet:connection — 2026-10-15 04:36 evidence →
27.217.161.106 scanner 16% 50 1 telnet:connection — 2026-10-12 08:14 evidence →
121.29.84.151 scanner 16% 4 1 ssh:connection — 2026-10-14 07:52 evidence →
175.149.78.162 scanner 16% 2 1 telnet:connection — 2026-10-14 18:45 evidence →
119.115.208.218 scanner 16% 2 1 telnet:connection — 2026-10-14 17:45 evidence →
218.59.177.216 scanner 15% 2 1 telnet:connection — 2026-10-14 09:56 evidence →
139.170.72.19 scanner 15% 2 1 ssh:connection — 2026-10-14 07:52 evidence →
182.88.135.209 scanner 14% 4 1 ssh:connection — 2026-10-13 09:18 evidence →
175.148.70.172 scanner 13% 2 1 telnet:connection — 2026-10-13 11:08 evidence →
115.46.144.221 scanner 13% 2 1 telnet:connection — 2026-10-13 06:22 evidence →
36.32.195.244 scanner 13% 4 1 telnet:connection — 2026-10-12 17:09 evidence →
122.97.214.237 scanner 13% 2 1 telnet:connection — 2026-10-13 02:03 evidence →
119.54.3.27 scanner 12% 2 1 telnet:connection 27.3.54.119.adsl-pool.jlccptt.net.cn 2026-10-13 00:17 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds