IntrusionLabs IntrusionLabs
← Back to feed

120.230.180.207

Threat Confidence
28%
Assessment
Port and service scanner
  • Ran 2 commands on the host.
  • Active for 8 days, 2026-09-20 to 2026-09-29.
  • Runs the same SSH client fingerprint (HASSH) as 49 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇨🇳 CN / Guangzhou
ASN
AS9808 · China Mobile Communications Group Co., Ltd.
Cloud Provider
—
Total Events
51
Above average by volume
Agent Count
1
First / Last Seen
2026-09-20 12:14 — 2026-09-29 10:27
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 03a80b21afa8… — SSH-2.0-libssh_0.11.1 (50 IPs, 18 countries) HASSH Active high 🇨🇳 CN
50 IPs 75852 events
ssh:bruteforcessh:connectionssh:intrusionssh:malware
2026-02-27 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 03a80b21afa8…). Top network: Chinanet (AS4134). Geographic and ASN …
Session Forensics
scanner ×6 reconnaissance ×1 credential_probe ×6
Sessions
13 (1 with login)
Avg Depth Score
0.21
Commands Executed
2
Files Downloaded
0
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
03a80b21afa810682a776a7d42e5e6fb
SSH Client
SSH-2.0-libssh_0.11.1
Evidence Timeline
Scanner 3368c598210d w4m_singapore_01 · 2026-09-29 10:25
15%
Loading events...
Credential Probe 9384ace25467 w4m_singapore_01 · 2026-09-29 10:22
1 20%
Loading events...
Scanner ede73905b6fa w4m_singapore_01 · 2026-09-29 10:17
15%
Loading events...
Reconnaissance 4b888dc312eb w4m_singapore_01 · 2026-09-29 10:11
2 1 60%
Loading events...
Credential Probe 8844dfda26ec w4m_singapore_01 · 2026-09-29 10:09
1 20%
Loading events...
Credential Probe 06f9694ff6b5 w4m_singapore_01 · 2026-09-29 10:06
1 20%
Loading events...
Credential Probe 2e6d0da7be0a w4m_singapore_01 · 2026-09-29 10:05
1 20%
Loading events...
Scanner f6b5c8e42000 w4m_singapore_01 · 2026-09-20 12:29
15%
Loading events...
Credential Probe ec2613107278 w4m_singapore_01 · 2026-09-20 12:29
1 20%
Loading events...
Scanner ef3e1166f885 w4m_singapore_01 · 2026-09-20 12:25
15%
Loading events...
Scanner 533882aa2670 w4m_singapore_01 · 2026-09-20 12:24
15%
Loading events...
Scanner 652ec779a5c5 w4m_singapore_01 · 2026-09-20 12:21
15%
Loading events...
Credential Probe 677089d27723 w4m_singapore_01 · 2026-09-20 12:14
1 20%
Loading events...