IntrusionLabs IntrusionLabs
← Back to feed

132.148.132.251

Threat Confidence
28%
Location
🇺🇸 US
ASN
AS398101 · GoDaddy.com, LLC
Cloud Provider
—
Total Events
54
Above average by volume
Agent Count
1
First / Last Seen
2026-07-27 10:22 — 2026-08-04 07:24
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 57e4cc8ee36c… — SSH-2.0-paramiko_1.12.4 (58 IPs, 14 countries) HASSH Active high 🇺🇸 US
58 IPs 113016 events
ssh:bruteforce
2026-03-12 — ongoing · 58 IPs are running an identical SSH client (HASSH fingerprint 57e4cc8ee36c…). Top network: GoDaddy.com, LLC (AS398101). Geographic and …
Session Forensics
scanner ×5 reconnaissance ×3 credential_probe ×4
Sessions
12 (3 with login)
Avg Depth Score
0.28
Commands Executed
3
Files Downloaded
0
Notable Commands
  • uname -a
Fingerprints
HASSH
57e4cc8ee36c3d78f75c6a05acd5596380d9e1d7a4faebe9cda3e69e3a839c6c
SSH Client
SSH-2.0-GoSSH-2.0-libssh2_1.11.1_DEV
Evidence Timeline
Reconnaissance b79c773c9f7a newark_01 · 2026-08-04 07:24
1 1 60%
Loading events...
Scanner 36bd2db26a06 newark_01 · 2026-08-04 07:24
15%
Loading events...
Reconnaissance 08c3a09f9e64 newark_01 · 2026-08-03 23:52
1 1 60%
Loading events...
Scanner 031cb236f095 newark_01 · 2026-08-03 23:52
15%
Loading events...
Credential Probe 82f31e2cd0c0 newark_01 · 2026-08-03 15:48
1 20%
Loading events...
Scanner e59d05a1a655 newark_01 · 2026-08-03 15:48
15%
Loading events...
Reconnaissance 5e75a3b8a737 newark_01 · 2026-08-02 21:31
1 1 60%
Loading events...
Scanner 505f02cab6f4 newark_01 · 2026-08-02 21:31
15%
Loading events...
Credential Probe 5d96a2ee2247 newark_01 · 2026-08-02 19:19
1 20%
Loading events...
Scanner ecc4346718bd newark_01 · 2026-08-02 19:19
15%
Loading events...
Credential Probe a50d4b68ad96 newark_01 · 2026-07-27 10:31
1 20%
Loading events...
Credential Probe e0df92ee9017 newark_01 · 2026-07-27 10:22
1 20%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}