IntrusionLabs IntrusionLabs
← Back to feed

116.203.126.161

Threat Confidence
29%
Location
🇩🇪 DE / Nuremberg
ASN
AS24940 · Hetzner Online GmbH
Cloud Provider
—
Total Events
117
Above average by volume
Agent Count
1
First / Last Seen
2026-07-26 13:36 — 2026-08-03 12:10
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 3044b58ed97c… — SSH-2.0-Go (50 IPs, 12 countries) HASSH Active high 🇺🇸 US
50 IPs 3125 events
ssh:bruteforce
2026-05-23 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 3044b58ed97c…). Top network: GoDaddy.com, LLC (AS398101). Geographic and …
HASSH 57e4cc8ee36c… — SSH-2.0-paramiko_1.12.4 (58 IPs, 14 countries) HASSH Active high 🇺🇸 US
58 IPs 113016 events
ssh:bruteforce
2026-03-12 — ongoing · 58 IPs are running an identical SSH client (HASSH fingerprint 57e4cc8ee36c…). Top network: GoDaddy.com, LLC (AS398101). Geographic and …
Session Forensics
scanner ×6 reconnaissance ×10 credential_probe ×5
Sessions
21 (10 with login)
Avg Depth Score
0.38
Commands Executed
10
Files Downloaded
0
Notable Commands
  • uname -a
  • echo ''
Fingerprints
HASSH
16443846184eafde36765c9bab2f43973044b58ed97c162e4bdcf93cbeccd7a657e4cc8ee36c3d78f75c6a05acd5596380d9e1d7a4faebe9cda3e69e3a839c6ce805c3a05028a204e7e9acb145704415
SSH Client
SSH-2.0-GoSSH-2.0-libssh2_1.11.1_DEV
Evidence Timeline
Reconnaissance d12766b9d8dc newark_01 · 2026-08-03 12:10
1 1 60%
Loading events...
Scanner 820b1f79d141 newark_01 · 2026-08-03 12:10
15%
Loading events...
Reconnaissance c700d7d548ec newark_01 · 2026-08-03 08:29
1 1 60%
Loading events...
Scanner ecbf721151fc newark_01 · 2026-08-03 08:29
15%
Loading events...
Reconnaissance 019b7bec69be newark_01 · 2026-08-03 07:47
1 1 60%
Loading events...
Scanner ba87fdbc183f newark_01 · 2026-08-03 07:47
15%
Loading events...
Reconnaissance 156ad37854c5 newark_01 · 2026-08-03 05:38
1 1 60%
Loading events...
Scanner c01f72f06dcf newark_01 · 2026-08-03 05:38
15%
Loading events...
Credential Probe ecc23e071f3b newark_01 · 2026-08-02 22:54
1 20%
Loading events...
Scanner dade205c4709 newark_01 · 2026-08-02 22:54
15%
Loading events...
Reconnaissance ee41e811ef12 newark_01 · 2026-08-02 16:42
1 1 60%
Loading events...
Credential Probe 3171b741a7a3 newark_01 · 2026-08-02 15:40
1 20%
Loading events...
Reconnaissance 2fec627c82f0 newark_01 · 2026-08-02 12:16
1 1 60%
Loading events...
Scanner e396b2d56f88 newark_01 · 2026-08-02 12:16
15%
Loading events...
Credential Probe 7d1ba407e42f newark_01 · 2026-07-27 10:29
1 20%
Loading events...
Credential Probe b98774fbd998 newark_01 · 2026-07-27 10:24
1 20%
Loading events...
Reconnaissance a867f7f1c74b newark_01 · 2026-07-27 06:05
1 1 60%
Loading events...
Reconnaissance 5fdd93b39f8b newark_01 · 2026-07-27 02:55
1 1 60%
Loading events...
Reconnaissance 85513ac09921 newark_01 · 2026-07-26 23:47
1 1 60%
Loading events...
Credential Probe afda2afb5b8b newark_01 · 2026-07-26 20:36
1 20%
Loading events...
Reconnaissance 5c5de1464b8b newark_01 · 2026-07-26 13:36
1 1 60%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}