← Back to feed

200.31.13.30

TAGGED SUSPICIOUS how we decide →

Threat Confidence

41%

Location

🇨🇴 CO / Cali

ASN

AS3549 · Level 3 Parent, LLC

Cloud Provider

—

Total Events

Above average by volume

Agent Count

First / Last Seen

2026-09-16 16:21 — 2026-09-17 05:34

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595.002

Initial Access

T1078

Credential Access

T1110 T1110.001

Discovery

T1016 T1082

External Corroboration

Blocklist.de

Reported 2026-09-19 11:00

blocklist_de:reported

Campaigns

AS3549 Level 3 Parent, LLC ASN Active medium 🇧🇷 BR

5 IPs 315 events

ssh:bruteforcetelnet:bruteforce

2026-09-12 — ongoing · 5 IPs from the same network (Level 3 Parent, LLC, AS3549) were active during overlapping time periods. Temporal …

HASSH 06ff3615a51b… — SSH-2.0-Go (649 IPs, 84 countries) HASSH Active high 🇮🇩 ID

649 IPs 83810 events

ftp:bruteforcehttp:scanssh:bruteforce

2026-05-21 — ongoing · 649 IPs are running an identical SSH client (HASSH fingerprint 06ff3615a51b…). Top network: DigitalOcean, LLC (AS14061). Geographic and …

Session Forensics

reconnaissance ×2 credential_probe ×5

Sessions

7 (2 with login)

Avg Depth Score

0.31

Commands Executed

Files Downloaded

Notable Commands

uname -a 2>/dev/null

Fingerprints

HASSH

06ff3615a51b2af343ec22abc8e30bbc

SSH Client

SSH-2.0-Go

Evidence Timeline

Credential Probe 0977efc9811d newark_01 · 2026-09-17 05:34

1 20%

Loading events...

Reconnaissance 68d630e9388d newark_01 · 2026-09-17 03:36

1 1 60%

Loading events...

Credential Probe e3ac4ec7657e newark_01 · 2026-09-17 02:00

1 20%

Loading events...

Credential Probe 39b8763bfc8b newark_01 · 2026-09-17 00:23

1 20%

Loading events...

Reconnaissance b397575634d0 newark_01 · 2026-09-16 22:48

1 1 60%

Loading events...

Credential Probe deda618fa451 newark_01 · 2026-09-16 19:14

1 20%

Loading events...

Credential Probe 955f64b9ef36 newark_01 · 2026-09-16 16:21

1 20%

Loading events...