← Back to feed
179.43.172.194
TAGGED SUSPICIOUS how we decide →
Why: Our sensors observed credential harvester sessions · certainty: inferred
Assessment
SSH password brute-forcer
- Runs the same SSH client fingerprint (HASSH) as 1,410 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇨🇭 CH / Rümlang
ASN
AS51852 · Private Layer INC
Cloud Provider
—
Total Events
25
Average by volume
Agent Count
1
First / Last Seen
2026-10-27 11:08 — 2026-10-27 11:18
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Blocklist.de
blocklist_de:reported
DShield Top Attackers
dshield:top_attacker
Campaigns
AS51852 Private Layer INC
ASN
Active
medium
🇨🇭 CH
6 IPs
113587 events
ssh:bruteforcessh:connectionssh:credential-reusessh:intrusionssh:malwaressh:proxy-abuse
2026-02-28 — ongoing · 6 IPs from the same network (Private Layer INC, AS51852) were active during overlapping time periods. Temporal correlation …
HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (1411 IPs, 91 countries)
HASSH
Active
high
🇺🇸 US
1411 IPs
1396480 events
ssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:intrusiontelnet:malware
2026-02-25 — ongoing · 1411 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Oracle Corporation (AS31898). Geographic and …
Session Forensics
Sessions
5
Avg Depth Score
0.2
Commands Executed
0
Files Downloaded
0
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
SSH Client
Evidence Timeline