IntrusionLabs IntrusionLabs
← Back to feed

212.28.186.96

vmi3518628.contaboserver.net (contaboserver.net) ✓ FCrDNS
Threat Confidence
34%
Assessment
Post-login reconnaissance: logs in and surveys the host
  • Logged in with 6 different credentials across 6 logins.
  • Ran 6 commands on the host.
  • Runs the same SSH client fingerprint (HASSH) as 120 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US / St Louis
ASN
AS40021 · Contabo Inc.
Cloud Provider
—
Total Events
48
Above average by volume
Agent Count
1
First / Last Seen
2026-10-15 10:19 — 2026-10-15 20:48
Attack Types
ssh:intrusion
MITRE ATT&CK Techniques
Initial Access
T1078
Execution
T1059.004
Discovery
T1016 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 0a07365cc01f… — SSH-2.0-Go (121 IPs, 16 countries) HASSH Active high 🇧🇬 BG
121 IPs 1921527 events
ftp:bruteforcessh:bruteforcessh:connectionssh:intrusiontelnet:bruteforcetelnet:connection
2026-02-22 — ongoing · 121 IPs are running an identical SSH client (HASSH fingerprint 0a07365cc01f…). Top network: TechTies Inc. (AS197170). Geographic and …
Session Forensics
reconnaissance ×6
Sessions
6 (6 with login)
Avg Depth Score
0.6
Commands Executed
6
Files Downloaded
0
Notable Commands
  • pwd
  • uname -a
  • env | head -10
  • hostname
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
0a07365cc01fa9fc82608ba4019af499
SSH Client
SSH-2.0-Go
Evidence Timeline
Reconnaissance 98d27f76152c w4m_singapore_01 · 2026-10-15 20:48
1 1 60%
Loading events...
Reconnaissance 8406781ac8f5 w4m_singapore_01 · 2026-10-15 16:38
1 1 60%
Loading events...
Reconnaissance b5590d75cf8b w4m_singapore_01 · 2026-10-15 16:29
1 1 60%
Loading events...
Reconnaissance 4b505ee3e5d5 w4m_singapore_01 · 2026-10-15 16:00
1 1 60%
Loading events...
Reconnaissance 52657f9385fc w4m_singapore_01 · 2026-10-15 11:20
1 1 60%
Loading events...
Reconnaissance f230f1f1451e w4m_singapore_01 · 2026-10-15 10:19
1 1 60%
Loading events...