IntrusionLabs IntrusionLabs
← Back to feed

148.135.0.242

Threat Confidence
28%
Location
🇺🇸 US / Los Angeles
ASN
AS35916 · MULTACOM CORPORATION
Cloud Provider
—
Total Events
51
Above average by volume
Agent Count
1
First / Last Seen
2026-08-23 17:46 — 2026-08-25 09:27
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 594c57870d0e… — SSH-2.0-Go (50 IPs, 15 countries) HASSH Ended high 🇺🇸 US
50 IPs 2275 events
ssh:bruteforce
2026-05-25 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 594c57870d0e…). Top network: OVH SAS (AS16276). Geographic and …
Session Forensics
reconnaissance ×2 credential_probe ×5 opportunistic_bruter ×2
Sessions
9 (4 with login)
Avg Depth Score
0.36
Commands Executed
2
Files Downloaded
0
Notable Commands
  • uname -a 2>/dev/null || echo 'Unknown'
Fingerprints
HASSH
000462cd09ade23ebf24f6015157ac000bfa2d6538f245a1d0b97ac0bc565a24594c57870d0ec290ad3f328d5116eb188260fe1ecd3a31ee0e32515164898df0905b174d1711551ef0b5aaa17c3773cb91d6126e51ba15b1a5faafe673e6565e9ea617b6e5691e25c0df984fefd0126fe8b0e4606f293d319c3dad46278f045b
SSH Client
SSH-2.0-Go
Evidence Timeline
Reconnaissance 73f6710e0327 newark_01 · 2026-08-25 09:27
1 1 60%
Loading events...
Credential Probe 3eee34de25cd newark_01 · 2026-08-24 17:35
1 20%
Loading events...
Credential Probe e93747fe69b2 newark_01 · 2026-08-24 03:53
1 20%
Loading events...
Credential Probe 3feaaf18d5a4 newark_01 · 2026-08-24 03:33
1 20%
Loading events...
Credential Probe e6ce39ab1dfa newark_01 · 2026-08-24 01:09
1 20%
Loading events...
Credential Probe 46a423f90388 newark_01 · 2026-08-24 00:49
1 20%
Loading events...
Opportunistic Bruter 7fba0f9bec0f newark_01 · 2026-08-23 22:27
1 50%
Loading events...
Opportunistic Bruter 42bdd37c17fa newark_01 · 2026-08-23 22:08
1 50%
Loading events...
Reconnaissance fafa49a9acfa newark_01 · 2026-08-23 17:46
1 1 60%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}