Team Cymru Reports Active Traffic on Sanctioned MediaLand Network

Summary

Team Cymru’s January 22–29, 2026 telemetry review found AS206728 (MediaLand), sanctioned in November 2025, remained active, with suspicious domains, Telnet scanning and traffic to UDP port 33445.

Key points

• Team Cymru assessed global network telemetry from January 22–29, 2026, for AS206728, identified as MediaLand and sanctioned by the U.S. Treasury in November 2025 for supporting ransomware and other cybercrime.
• The report says AS206728 advertises approximately 2,048 IP addresses and was not dormant during the observation period.
• The analysis identified hosted domains with characteristics of typosquatting and brand impersonation, including apparent imitations of delivery services and consumer-facing platforms.
• Outbound Telnet traffic on port 23 was the highest-volume traffic category observed; Brazil was the most heavily targeted destination country for those scans.
• The report observed traffic to UDP port 33445, which it describes as commonly associated with Tox-based peer-to-peer command-and-control frameworks. The observation is not evidence by itself that the traffic was malware command and control.
• Team Cymru says the observed activity indicates ongoing security and compliance risks, but the article does not establish specific victim infections or losses.

MITRE ATT&CK

People

Malware

Countries

Industries