← Back to feed

102.220.160.39

TAGGED SUSPICIOUS how we decide →

Threat Confidence

52%

Location

🇳🇬 NG

ASN

AS197769 · VPS Dedicated LLC

Cloud Provider

—

Total Events

Above average by volume

Agent Count

First / Last Seen

2026-05-19 16:10 — 2026-07-10 08:04

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Credential Access

T1110 T1110.001

Discovery

T1046

Command and Control

T1090 T1572

External Corroboration

Blocklist.de

Reported 2026-07-17 21:03

blocklist_de:reported

DShield Top Attackers

Reported 2026-07-17 21:01

dshield:top_attacker

Campaigns

Multi-Agent Scan SCAN Active medium

42 IPs 29857 events

2026-07-03 — ongoing · 42 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

3 IPs 146 events

2026-05-19 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Vultr. Scanning the same …

Multi-Agent Scan SCAN Active medium

49 IPs 56979 events

2026-05-19 — ongoing · 49 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

21 IPs 7842 events

2026-05-19 — ongoing · 21 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …

Multi-Agent Scan SCAN Active medium

3 IPs 310 events

2026-05-19 — ongoing · 3 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

36 IPs 10392 events

2026-05-19 — ongoing · 36 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

68 IPs 62229 events

2026-05-19 — ongoing · 68 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

35 IPs 13924 events

2026-05-19 — ongoing · 35 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

49 IPs 50045 events

2026-05-19 — ongoing · 49 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

57 IPs 17698 events

2026-05-19 — ongoing · 57 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

65 IPs 63301 events

2026-05-19 — ongoing · 65 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

68 IPs 124341 events

2026-05-19 — ongoing · 68 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

5 IPs 2236 events

2026-05-19 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

12 IPs 471 events

2026-05-19 — ongoing · 12 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

2 IPs 1660 events

2026-05-19 — ongoing · 2 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

36 IPs 10761 events

2026-05-19 — ongoing · 36 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Subnet 102.220.160.0/24 SUBNET Ended high 🇳🇬 NG

3 IPs 220 events

ssh:bruteforce

2026-05-19 — 2026-06-25 · 3 IPs from the same /24 subnet (102.220.160.0/24) were observed attacking our sensors within the same time window. …

Multi-Agent Scan SCAN Active medium

63 IPs 112447 events

2026-05-06 — ongoing · 63 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …

Multi-Agent Scan SCAN Active medium

64 IPs 109434 events

2026-05-06 — ongoing · 64 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

65 IPs 109527 events

2026-05-06 — ongoing · 65 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

25 IPs 7376 events

2026-05-04 — ongoing · 25 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

26 IPs 6656 events

2026-04-28 — ongoing · 26 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

20 IPs 4259 events

2026-04-27 — ongoing · 20 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

131 IPs 194351 events

2026-04-24 — ongoing · 131 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

33 IPs 4799 events

2026-04-15 — ongoing · 33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

43 IPs 44752 events

2026-04-01 — ongoing · 43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

15 IPs 3629 events

2026-03-30 — ongoing · 15 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

33 IPs 14842 events

2026-03-28 — ongoing · 33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

69 IPs 44992 events

2026-03-16 — ongoing · 69 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

38 IPs 98007 events

2026-03-13 — ongoing · 38 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

64 IPs 108372 events

2026-03-10 — ongoing · 64 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

50 IPs 51805 events

2026-03-09 — ongoing · 50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

35 IPs 11659 events

2026-03-09 — ongoing · 35 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

47 IPs 41341 events

2026-03-05 — ongoing · 47 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Multi-Agent Scan SCAN Active medium

77 IPs 68357 events

2026-03-05 — ongoing · 77 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Azure. Scanning the same …

Multi-Agent Scan SCAN Active medium

27 IPs 9616 events

2026-03-01 — ongoing · 27 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

Session Forensics

scanner ×1 proxy_abuser ×3 credential_probe ×3

Sessions

7 (3 with login)

Avg Depth Score

0.47

Commands Executed

Files Downloaded

Fingerprints

HASSH

4ed0d5b0dc3be39c7f96ba3a3cc77895

SSH Client

SSH-2.0-libssh_0.11.3SSH-2.0-libssh_0.11.4

Evidence Timeline

Proxy Abuser 0d658cc5f4ab newark_01 · 2026-07-10 08:04

1 85%

Loading events...

Proxy Abuser ece3f9e800d7 newark_01 · 2026-07-10 08:03

1 85%

Loading events...

Credential Probe a8b23f64d97c newark_01 · 2026-07-10 08:03

1 20%

Loading events...

Credential Probe 0aa0e6c686cc newark_01 · 2026-07-10 08:02

1 20%

Loading events...

Proxy Abuser ac8a079bd7d4 newark_01 · 2026-07-10 08:02

1 85%

Loading events...

Credential Probe 8760d17c371d w4m_singapore_01 · 2026-05-19 16:10

1 20%

Loading events...

Scanner 1bf5fd28e678 w4m_singapore_01 · 2026-05-19 16:10

15%

Loading events...