IntrusionLabs IntrusionLabs
← Back to feed

181.214.83.147

Threat Confidence
28%
Location
🇺🇸 US / Buffalo
ASN
AS14670 · WHG Hosting Services Ltd
Cloud Provider
—
Total Events
71
Above average by volume
Agent Count
1
First / Last Seen
2026-07-26 08:49 — 2026-08-24 17:41
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
Subnet 181.214.83.0/24 SUBNET Active high 🇺🇸 US
3 IPs 102 events
ssh:bruteforce
2026-07-26 — ongoing · 3 IPs from the same /24 subnet (181.214.83.0/24) were observed attacking our sensors within the same time window. …
HASSH 594c57870d0e… — SSH-2.0-Go (50 IPs, 15 countries) HASSH Active high 🇺🇸 US
50 IPs 2275 events
ssh:bruteforce
2026-05-25 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 594c57870d0e…). Top network: OVH SAS (AS16276). Geographic and …
HASSH 57e4cc8ee36c… — SSH-2.0-paramiko_1.12.4 (58 IPs, 14 countries) HASSH Active high 🇺🇸 US
58 IPs 113016 events
ssh:bruteforce
2026-03-12 — ongoing · 58 IPs are running an identical SSH client (HASSH fingerprint 57e4cc8ee36c…). Top network: GoDaddy.com, LLC (AS398101). Geographic and …
Session Forensics
scanner ×2 reconnaissance ×4 credential_probe ×5 opportunistic_bruter ×2
Sessions
13 (6 with login)
Avg Depth Score
0.36
Commands Executed
4
Files Downloaded
0
Notable Commands
  • uname -a
  • echo ''
Fingerprints
HASSH
16443846184eafde36765c9bab2f439757e4cc8ee36c3d78f75c6a05acd55963594c57870d0ec290ad3f328d5116eb188084862477a9bf8846bb4bdcf49310db80d9e1d7a4faebe9cda3e69e3a839c6cf9eb689e9248ae810d5e8ce976bed44d
SSH Client
SSH-2.0-GoSSH-2.0-libssh2_1.11.1_DEV
Evidence Timeline
Opportunistic Bruter 02d2a0284b89 newark_01 · 2026-08-24 17:41
1 50%
Loading events...
Opportunistic Bruter 3a52f153d3e7 newark_01 · 2026-08-24 07:32
1 50%
Loading events...
Reconnaissance 787fed8e3abe newark_01 · 2026-08-03 12:14
1 1 60%
Loading events...
Scanner b6a7d3a126e2 newark_01 · 2026-08-03 12:14
15%
Loading events...
Reconnaissance 71cb6ab5baa7 newark_01 · 2026-08-02 21:45
1 1 60%
Loading events...
Scanner 42b1e89ddac2 newark_01 · 2026-08-02 21:45
15%
Loading events...
Reconnaissance 5b33ffad4ade newark_01 · 2026-08-02 17:22
1 1 60%
Loading events...
Credential Probe 860a16b4417e newark_01 · 2026-07-27 10:32
1 20%
Loading events...
Credential Probe ea40259251ea newark_01 · 2026-07-26 22:49
1 20%
Loading events...
Credential Probe 09ecdbaeab30 newark_01 · 2026-07-26 22:49
1 20%
Loading events...
Credential Probe 2fc5f2f87d8e newark_01 · 2026-07-26 14:10
1 20%
Loading events...
Credential Probe 4eb1d4c624a1 newark_01 · 2026-07-26 14:10
1 20%
Loading events...
Reconnaissance 055c5a51c6eb newark_01 · 2026-07-26 08:49
1 1 60%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}