Liso · Vector 10

Liso: TCP handshake then raw packets

Starts a stream connection, obtains TCP state from received packets and then sends crafted TCP traffic with optional payload.

22 observations · Last 30 days · Latest observation 2026-10-31 18:40:53 UTC

Most affected countries

Poland10
United States9
United Kingdom1
Hong Kong1
Portugal1

Most affected networks

PEG TECH INCAS3988239
SkyPass Solutions Sp. z o.o.AS2025208
MatHost.euAS2147622
FREAKHOSTING LTDAS2157031
Alibaba (US) Technology Co., Ltd.AS451021
DIAMWALL, LDAAS2077311

Recent observations

2026-10-31 18:40:53 UTCTCP handshake then raw packets89.144.32.0/24TCP/255651mPoland
2026-10-31 07:44:43 UTCTCP handshake then raw packets109.176.229.165/32TCP/211mUnited Kingdom
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.63.252.206/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.63.238.217/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.63.252.193/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.6.95.162/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.6.89.193/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.63.252.218/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.48.248.154/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.6.95.167/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets38.6.89.217/32TCP/801mUnited States
2026-10-30 23:00:22 UTCTCP handshake then raw packets47.57.138.239/32TCP/801mHong Kong
2026-10-30 20:25:29 UTCTCP handshake then raw packets89.144.32.0/24TCP/801mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.228/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.225/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.224/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.221/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.213/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.212/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.204/32TCP/301201mPoland
2026-10-30 20:23:08 UTCTCP handshake then raw packets147.79.24.203/32TCP/301201mPoland
2026-10-30 19:42:08 UTCTCP handshake then raw packets216.146.31.149/32TCP/301201mPortugal

botnet.cl reports infrastructure it observed. An address appearing here identifies a target or a relay, not a person responsible for the attack.