IntrusionLabs IntrusionLabs
← Back to feed

AS45090 Shenzhen Tencent Computer Systems Company Limited

ASN Active medium
Why this campaign was detected
31 IPs from the same network (Shenzhen Tencent Computer Systems Company Limited, AS45090) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS45090 · Shenzhen Tencent Computer Systems Company Limited
Subnet
—
Country
🇨🇳 CN
Cloud Provider
—
Member Count
31 IPs
Below average
Total Events
1361
Below average by volume
Started / Ended
2026-03-06 13:09 — ongoing
Attack Types
http:scan ssh:bruteforce ssh:connection ssh:intrusion ssh:malware telnet:bruteforce telnet:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
81.68.238.92 credential_harvester 59% 612 2 ssh:bruteforcessh:connectionssh:malware — 2026-10-16 20:30 evidence →
42.194.237.235 credential_harvester 56% 1x OSINT 134 1 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-18 18:13 evidence →
119.91.20.139 web_probe 52% 44 1 http:scan — 2026-10-17 18:43 evidence →
119.29.252.115 malware_dropper 51% 1x OSINT 23 1 ssh:bruteforcessh:malware — 2026-10-17 17:07 evidence →
111.230.233.46 web_probe 39% 32 1 http:scan — 2026-10-18 22:34 evidence →
139.155.134.17 web_probe 39% 22 1 http:scan — 2026-10-19 04:12 evidence →
122.51.236.174 web_probe 38% 25 1 http:scan — 2026-10-18 10:37 evidence →
106.54.62.156 web_probe 38% 21 1 http:scan — 2026-10-18 11:29 evidence →
43.138.68.113 web_probe 36% 27 1 http:scan — 2026-10-17 13:01 evidence →
175.27.163.171 web_probe 35% 33 1 http:scan — 2026-10-16 19:12 evidence →
146.56.197.150 web_probe 35% 27 1 http:scan — 2026-10-16 19:46 evidence →
49.235.157.138 credential_probe 33% 1x OSINT 85 2 ssh:bruteforcessh:connectionssh:intrusionssh:malware — 2026-10-14 08:25 evidence →
192.144.148.122 web_probe 33% 26 1 http:scan — 2026-10-15 22:44 evidence →
49.233.45.47 web_probe 32% 28 1 http:scan — 2026-10-15 09:21 evidence →
111.229.129.233 credential_probe 32% 1x OSINT 43 1 telnet:bruteforcetelnet:intrusion — 2026-10-19 01:58 evidence →
1.12.70.96 web_probe 32% 20 1 http:scan — 2026-10-15 09:44 evidence →
81.71.68.89 web_probe 30% 1x OSINT 2 1 http:scan — 2026-10-18 17:10 evidence →
146.56.199.139 web_probe 29% 14 1 http:scan — 2026-10-14 06:14 evidence →
1.15.52.154 web_probe 29% 19 1 http:scan — 2026-10-13 21:30 evidence →
49.235.136.28 web_probe 28% 21 1 http:scan — 2026-10-13 10:38 evidence →
101.42.0.42 credential_probe 28% 1x OSINT 43 1 telnet:bruteforcetelnet:intrusion — 2026-10-16 19:30 evidence →
49.232.88.176 web_probe 26% 3 1 http:scan — 2026-10-18 23:37 evidence →
81.70.249.96 opportunistic_bruter 26% 12 1 ssh:bruteforcessh:intrusion — 2026-10-13 01:52 evidence →
175.27.171.245 web_probe 26% 22 1 http:scan — 2026-10-12 09:42 evidence →
124.220.20.99 web_probe 26% 3 1 http:scan — 2026-10-18 17:13 evidence →
118.25.195.79 web_probe 24% 2 1 http:scan — 2026-10-17 21:26 evidence →
132.232.242.146 web_probe 23% 2 1 http:scan — 2026-10-17 14:53 evidence →
101.34.54.56 web_probe 23% 2 1 http:scan — 2026-10-17 08:08 evidence →
43.136.79.172 credential_probe 20% 1x OSINT 10 1 telnet:bruteforce — 2026-10-13 20:44 evidence →
139.155.136.89 web_probe 19% 2 1 http:scan — 2026-10-15 02:28 evidence →
81.70.55.207 scanner 17% 1x OSINT 2 1 ssh:connection — 2026-10-13 02:21 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds