← Back to feed

209.99.185.239

TAGGED SUSPICIOUS how we decide →

Threat Confidence

16%

Location

🇨🇭 CH / Zurich

ASN

AS402253 · SKN Subnet & Telecom Ltd

Cloud Provider

—

Total Events

Below average by volume

Agent Count

First / Last Seen

2026-05-22 19:20 — 2026-05-22 19:21

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1078

Credential Access

T1110 T1110.001

Discovery

T1046

External Corroboration

Blocklist.de

Reported 2026-05-30 20:02

blocklist_de:reported

Campaigns

Multi-Agent Scan SCAN Active medium

69 IPs 166497 events

2026-03-03 — ongoing · 69 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …

HASSH 19532158b559… — SSH-2.0-libssh2_1.11.1 (50 IPs, 19 countries) HASSH Active high 🇺🇸 US

50 IPs 1312 events

ssh:bruteforce

2026-02-22 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 19532158b559…). Top network: UCLOUD INFORMATION TECHNOLOGY HK LIMITED …

Session Forensics

scanner ×1 credential_probe ×2 opportunistic_bruter ×1

Sessions

4 (1 with login)

Avg Depth Score

0.26

Commands Executed

Files Downloaded

Fingerprints

HASSH

19532158b559096b89b1a5f7d17175b2

SSH Client

SSH-2.0-libssh2_1.11.1

Evidence Timeline

Opportunistic Bruter 8506ed9f7fca w4m_singapore_01 · 2026-05-29 19:21

1 50%

Loading events...

Credential Probe 53fdc55402bb w4m_singapore_01 · 2026-05-29 19:16

1 20%

Loading events...

Credential Probe 2301b7d46654 w4m_singapore_01 · 2026-05-29 19:11

1 20%

Loading events...

Scanner de63cb2f7d78 newark_01 · 2026-05-22 19:20

15%

Loading events...