← Back to feed

138.68.22.250

Threat Confidence

43%

Assessment

Post-login reconnaissance: logs in and surveys the host

Logged in with 3 different credentials across 3 logins.
Ran 3 commands on the host.
Runs the same SSH client fingerprint (HASSH) as 67 other IPs.

Generated from the counts on this page by fixed rules; each line cites the number it rests on.

Location

🇺🇸 US / Santa Clara

ASN

AS14061 · DigitalOcean, LLC

Cloud Provider

DigitalOcean

Total Events

Average by volume

Agent Count

First / Last Seen

2026-10-18 11:24 — 2026-10-18 11:32

Attack Types

ssh:connection ssh:intrusion

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001

Initial Access

T1078

Execution

T1059.004

Discovery

T1016 T1046 T1082

External Corroboration

Blocklist.de

Reported 2026-10-19 05:01

blocklist_de:reported

Campaigns

HASSH 16443846184e… — SSH-2.0-Go (68 IPs, 20 countries) HASSH Active high 🇺🇸 US

68 IPs 133038 events

ftp:bruteforcemysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusiontelnet:malware

2026-02-22 — ongoing · 68 IPs are running an identical SSH client (HASSH fingerprint 16443846184e…). Top network: DigitalOcean, LLC (AS14061). Geographic and …

Session Forensics

scanner ×1 reconnaissance ×3

Sessions

4 (3 with login)

Avg Depth Score

0.49

Commands Executed

Files Downloaded

Notable Commands

/bin/./uname -s -v -n -r -m

Fingerprints

1 SSH client banner · 1 HASSH fingerprint

HASSH

16443846184eafde36765c9bab2f4397

SSH Client

SSH-2.0-Go

Evidence Timeline

Reconnaissance 3617dc2f94a9 greencloud_phx_01 · 2026-10-18 11:32

1 1 60%

Loading events...

Reconnaissance 78d68fcebca0 greencloud_phx_01 · 2026-10-18 11:29

1 1 60%

Loading events...

Reconnaissance cb60bf893786 greencloud_phx_01 · 2026-10-18 11:27

1 1 60%

Loading events...

Scanner db2e5b9da1af greencloud_phx_01 · 2026-10-18 11:24

15%

Loading events...