IntrusionLabs IntrusionLabs
← Back to feed

220.117.241.220

cm5.companymail.co.kr (companymail.co.kr) ✗ FCrDNS
Threat Confidence
42%
Assessment
Post-login reconnaissance: logs in and surveys the host
  • Logged in with 64 different credentials across 64 logins.
  • Ran 62 commands on the host.
  • Runs the same SSH client fingerprint (HASSH) as 151 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR / Gwangjin-gu
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
773
Top 5% by volume
Agent Count
1
First / Last Seen
2026-09-30 13:57 — 2026-10-07 11:37
Attack Types
ssh:bruteforce ssh:connection ssh:intrusion
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 06ff3615a51b… — SSH-2.0-Go (152 IPs, 44 countries) HASSH Active high 🇻🇳 VN
152 IPs 168342 events
ftp:bruteforcessh:bruteforcessh:connectionssh:intrusion
2026-05-21 — ongoing · 152 IPs are running an identical SSH client (HASSH fingerprint 06ff3615a51b…). Top network: Tencent Building, Kejizhongyi Avenue (AS132203). …
Session Forensics
scanner ×1 reconnaissance ×62 credential_probe ×52 opportunistic_bruter ×2
Sessions
117 (64 with login)
Avg Depth Score
0.42
Commands Executed
62
Files Downloaded
0
Notable Commands
  • uname -a 2>/dev/null
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
06ff3615a51b2af343ec22abc8e30bbc
SSH Client
SSH-2.0-Go
Evidence Timeline
Credential Probe 1f1fd66a3203 newark_01 · 2026-10-07 11:37
1 20%
Loading events...
Reconnaissance f4fce5ebd261 newark_01 · 2026-10-07 11:24
1 1 60%
Loading events...
Credential Probe 7f7d41a49d44 newark_01 · 2026-10-07 11:12
1 20%
Loading events...
Credential Probe c510fb3c135a newark_01 · 2026-10-07 10:49
1 20%
Loading events...
Opportunistic Bruter 8088802a3191 newark_01 · 2026-10-07 10:39
1 50%
Loading events...
Reconnaissance 2e99780dcf86 newark_01 · 2026-10-07 07:41
1 1 60%
Loading events...
Credential Probe 2f50ed06f710 newark_01 · 2026-10-07 07:36
1 20%
Loading events...
Credential Probe 06dae844b438 newark_01 · 2026-10-07 07:18
1 20%
Loading events...
Reconnaissance f2f3abd59c83 newark_01 · 2026-10-07 07:00
1 1 60%
Loading events...
Credential Probe aa28217c7f77 newark_01 · 2026-10-07 06:42
1 20%
Loading events...
Reconnaissance e8c842607216 newark_01 · 2026-10-07 06:23
1 1 60%
Loading events...
Reconnaissance dc76f3d3aca7 newark_01 · 2026-10-07 06:05
1 1 60%
Loading events...
Reconnaissance 065a31b2a6eb newark_01 · 2026-10-07 05:47
1 1 60%
Loading events...
Credential Probe 814720570db1 newark_01 · 2026-10-07 05:28
1 20%
Loading events...
Reconnaissance f8a43467ec9c newark_01 · 2026-10-07 05:10
1 1 60%
Loading events...
Reconnaissance bb2d35c11835 newark_01 · 2026-10-07 04:52
1 1 60%
Loading events...
Reconnaissance ffa2cbddab08 newark_01 · 2026-10-07 04:33
1 1 60%
Loading events...
Credential Probe 87e66149e236 newark_01 · 2026-10-07 04:15
1 20%
Loading events...
Reconnaissance 42b001e73ec1 newark_01 · 2026-10-07 03:56
1 1 60%
Loading events...
Reconnaissance c4e787ccc240 newark_01 · 2026-10-07 03:38
1 1 60%
Loading events...
Credential Probe 46cefd44a00a newark_01 · 2026-10-07 03:20
1 20%
Loading events...
Reconnaissance f954ff24434b newark_01 · 2026-10-07 03:02
1 1 60%
Loading events...
Reconnaissance a6f49f6b8ccd newark_01 · 2026-10-07 02:43
1 1 60%
Loading events...
Credential Probe b557793751c1 newark_01 · 2026-10-07 02:25
1 20%
Loading events...
Opportunistic Bruter 8c58697cb67c newark_01 · 2026-10-07 02:07
1 50%
Loading events...
Reconnaissance 902b5d027b80 newark_01 · 2026-10-07 01:49
1 1 60%
Loading events...
Credential Probe 23149dc5907f newark_01 · 2026-10-07 01:31
1 20%
Loading events...
Credential Probe 3a72bc7b9b00 newark_01 · 2026-10-07 01:12
1 20%
Loading events...
Reconnaissance cde2b8609eed newark_01 · 2026-10-07 00:54
1 1 60%
Loading events...
Reconnaissance 3839abd2cc53 newark_01 · 2026-10-07 00:36
1 1 60%
Loading events...
Reconnaissance 4f26e7d11542 newark_01 · 2026-10-07 00:18
1 1 60%
Loading events...
Credential Probe ac0a52fb197a newark_01 · 2026-10-06 23:41
1 20%
Loading events...
Credential Probe 16bd9366f271 newark_01 · 2026-10-06 23:23
1 20%
Loading events...
Credential Probe d748325cc6f6 newark_01 · 2026-10-06 23:05
1 20%
Loading events...
Reconnaissance 0832fccdfbf5 newark_01 · 2026-10-06 22:46
1 1 60%
Loading events...
Reconnaissance 85a45683e92a newark_01 · 2026-10-06 22:28
1 1 60%
Loading events...
Credential Probe dd5cc9de11bd newark_01 · 2026-10-06 22:10
1 20%
Loading events...
Credential Probe 86487013dc3b newark_01 · 2026-10-06 21:52
1 20%
Loading events...
Credential Probe 809dab2b6e22 newark_01 · 2026-10-06 21:34
1 20%
Loading events...
Credential Probe 825e32e3bbd1 newark_01 · 2026-10-06 21:16
1 20%
Loading events...
Reconnaissance 5a4aaa588dad newark_01 · 2026-10-06 20:57
1 1 60%
Loading events...
Reconnaissance 2e5b12911456 newark_01 · 2026-10-06 20:34
1 1 60%
Loading events...
Reconnaissance d7d9151e6ec5 newark_01 · 2026-10-06 19:41
1 1 60%
Loading events...
Credential Probe 4a0a938e9b3e newark_01 · 2026-10-06 19:27
1 20%
Loading events...
Credential Probe 40a9fad10382 newark_01 · 2026-10-06 16:09
1 20%
Loading events...
Credential Probe 765ef0660acf newark_01 · 2026-10-06 15:39
1 20%
Loading events...
Credential Probe 125a1edf928c newark_01 · 2026-10-06 15:29
1 20%
Loading events...
Credential Probe 5bb31e99a069 newark_01 · 2026-10-06 15:08
1 20%
Loading events...
Credential Probe 0f4830b02133 newark_01 · 2026-10-06 15:00
1 20%
Loading events...
Credential Probe 21903329e242 newark_01 · 2026-10-06 14:40
1 20%
Loading events...