IOC Radar
IPMediumSignal 68/100

120.48.36.229

Location
ChinaChina
Beijing, Beijing
ASN
AS38365
Beijing Baidu Netcom Science and Technology Co., Ltd.
First Seen
Apr 11, 2026
Last Seen
May 31, 2026
Apr 11
First Seen
63d ago
May 31
Last Seen
14d ago
16
Reports
source reports
68%
Confidence
medium
Found in 16 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
68%
Signal Score
68 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

7 techniques

Network Information

CountryCNChina
RegionBeijing, Beijing
ASNAS38365
OrganizationBeijing Baidu Netcom Science and Technology Co., Ltd.

Feed Intelligence Summary

16 reports68% confidence
16
Source reports
68%
Confidence score
Category tags
abuseactive scanactive scanningapacheapache attackeraptasiabad reputationbrute forcebrute force attackbrute force attackerbrute-forcebruteforcechinacncredential accesscredential stuffingexploitexploitation activityexploited hosthackingidentity & access exploitationindicatornetworkpassword attacksportscanreconnaissanceresearchedscannerscannersself-signedservice scansshssh attackt1110.001t1110.002t1110.003t1110.004t1595.001t1595.002t1595.003threat actortor nodetpotvulnerability scanvulnerability-exploitationvultrweb app attack

Activity Timeline

1 total obs
May 31May 31

Threat Activity Heatmap

· Peak: 2026-05-31
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
68
SIGNAL
Signal Score
68%
Confidence
16
Reports
First seenApr 11, 2026
Last seenMay 31, 2026
GeolocationCN
CountryChina
LocationBeijing, Beijing
ASNAS38365
OrgBeijing Baidu Netcom Science and Technology Co., Ltd.
Coords34.7732, 113.7220

VirusTotal

Not checked

WHOIS

description
IPv4 hosts detected attempting to brute force SSH on Vultr Melbourne (Australia) honeypot
raw
inetnum: 120.48.0.0 - 120.49.255.255 netname: Baidu descr: Beijing Baidu Netcom Science and Technology Co., Ltd. descr: Baidu Plaza, No.10, Shangdi 10th street, descr: Haidian District Beijing,100080 country: CN admin-c: BN261-AP tech-c: BN261-AP abuse-c: AC1601-AP status: ALLOCATED PORTABLE mnt-by: MAINT-CNNIC-AP mnt-irt: IRT-BAIDU-CN mnt-lower: MAINT-CNNIC-AP mnt-routes: MAINT-CNNIC-AP last-modified: 2024-03-11T23:28:49Z source: APNIC irt: IRT-BAIDU-CN address: 12f,lixiang building ,zhongguancun,beijing e-mail: [email protected] abuse-mailbox: [email protected] admin-c: ZKY3-AP tech-c: ZKY3-AP auth: # Filtered mnt-by: MAINT-CNNIC-AP last-modified: 2025-11-18T00:35:07Z source: APNIC role: ABUSE CNNICCN country: ZZ address: Beijing, China phone: +000000000 e-mail: [email protected] admin-c: IP50-AP tech-c: IP50-AP nic-hdl: AC1601-AP remarks: Generated from irt object IRT-CNNIC-CN remarks: [email protected] is invalid abuse-mailbox: [email protected] mnt-by: APNIC-ABUSE last-modified: 2025-09-19T17:20:32Z source: APNIC person: Baidu Noc address: Baidu Campus,NO.10 Shangdi 10th Street,Haidian District,Beijing The People's Republic of China 100085 country: CN phone: +86-18110062082 e-mail: [email protected] nic-hdl: BN261-AP mnt-by: MAINT-CNNIC-AP last-modified: 2024-03-11T23:28:23Z source: APNIC
references
https://jamesbrine.com.au/vultrmelbournetest-portscan-bruteforce-ip-list-2026-04-16/, https://jamesbrine.com.au, https://jamesbrine.com.au/vultrmelbournetest-ssh-bruteforce-ip-list-2026-04-16/

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 2 months ago · Last seen 14 days ago
Appeared in 16 threat reports