43.142.113.25

Summary (Bottom Line Up Front)

** IP address 43.142.113.25 conducted sustained credential brute-force attacks against Telnet services over an 8-hour period on March 27, 2026, generating 394 malicious events. This represents a MEDIUM threat level with moderate sophistication targeting weak authentication mechanisms. Network defenders should immediately audit Telnet exposure and implement enhanced monitoring for credential-based attacks. **

TCP TCP/SYN TELNET Telnet
Activity Timeline
INITIAL REPORT2026-03-31T23:54:17Z
Source: Analyst Manual Entry
IP address 43.142.113.25 conducted sustained credential brute-force attacks against Telnet services over an 8-hour period on March 27, 2026, generating 394 malicious events. This represents a MEDIUM threat level with moderate sophistication targeting weak authentication mechanisms. Network defenders should immediately audit Telnet exposure and implement enhanced monitoring for credential-based attacks.
Technical details
  • Attack Vector: Sustained credential brute-force campaign targeting Telnet services (TCP/23)
  • Volume: 394 attack events over 8-hour window (11:00-19:00 UTC, March 27, 2026)
  • Protocols: TCP, Telnet with focus on authentication bypass attempts
  • MITRE Mapping: T1110.001 (Brute Force: Password Guessing)
  • Pattern Analysis: Primary attack patterns include credential capture and authentication retry mechanisms
  • IOC: 43.142.113.25 (source IP, unknown geolocation/ASN)
  • Targeting: Single destination port indicating focused reconnaissance and exploitation
IOCs
IP:43.142.113.25
Recommendations
  • Immediately inventory and disable unnecessary Telnet services across network infrastructure
  • Implement account lockout policies and rate limiting for authentication attempts on remaining legacy services
  • Deploy network segmentation to isolate systems requiring Telnet access from broader network
  • Enable enhanced logging and alerting for repeated authentication failures across all remote access protocols
  • Consider migrating Telnet-dependent systems to SSH or other encrypted alternatives where operationally feasible