IntrusionLabs IntrusionLabs
← Back to feed

220.86.129.106

Threat Confidence
29%
Location
🇰🇷 KR / Seo-gu
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
92
Above average by volume
Agent Count
1
First / Last Seen
2026-08-08 17:35 — 2026-08-24 06:11
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH a4bb6308c6d3… — SSH-2.0-Go (74 IPs, 22 countries) HASSH Ended high 🇩🇪 DE
74 IPs 2741 events
ssh:bruteforce
2026-08-03 — ongoing · 74 IPs are running an identical SSH client (HASSH fingerprint a4bb6308c6d3…). Top network: netcup GmbH (AS197540). Geographic and …
Session Forensics
reconnaissance ×4 credential_probe ×3 opportunistic_bruter ×9
Sessions
16 (13 with login)
Avg Depth Score
0.47
Commands Executed
4
Files Downloaded
0
Notable Commands
  • uname -a 2>/dev/null || echo 'Unknown'
  • uname -a
Fingerprints
HASSH
10f7aa1b54e1a94630c47dcdf918c1f9351cba5cd2cb25f840ef95e8badfc76e36fe3063d9748cf576343af96d7b98453cbf03544f7804a01103f12c8f84fe5b7a3f17f6ed62b07aaaf0a3c1f6d48c197d37db77bf2633cf00322db231e88f1d95a5bc65ee7c63bdc261c36aa73970b89dda4a165507bf8c809b051ef28cd21ea4bb6308c6d3a1e3fe1a437ba6ba379ac37911009092bf8d11043acb83be1a6cdf5fdd901f9a2eb080d21db5c2aeaf31e72cc11299630782f4b51efec0cbac56e8e6357af07ba26ae7427868d6ace0e8efe14cc04eafd800dc9cfb4b1c1e8c38
SSH Client
SSH-2.0-Go
Evidence Timeline
Opportunistic Bruter fde7c835e995 newark_01 · 2026-08-24 06:11
1 50%
Loading events...
Opportunistic Bruter 04c6d62922d7 newark_01 · 2026-08-24 05:48
1 50%
Loading events...
Opportunistic Bruter 1723cf8bb333 newark_01 · 2026-08-24 03:13
1 50%
Loading events...
Opportunistic Bruter 18c1f46bacba newark_01 · 2026-08-24 02:50
1 50%
Loading events...
Opportunistic Bruter 76417b556caf newark_01 · 2026-08-24 00:17
1 50%
Loading events...
Opportunistic Bruter 4d251d23c618 newark_01 · 2026-08-23 23:54
1 50%
Loading events...
Opportunistic Bruter e4cab52bf9e5 newark_01 · 2026-08-23 21:25
1 50%
Loading events...
Opportunistic Bruter 7eac59666a38 newark_01 · 2026-08-23 21:04
1 50%
Loading events...
Opportunistic Bruter 607acc2b1920 newark_01 · 2026-08-23 19:44
1 50%
Loading events...
Credential Probe 8ec2b1243887 newark_01 · 2026-08-23 18:15
1 20%
Loading events...
Reconnaissance c2251eeb0459 newark_01 · 2026-08-23 17:53
1 1 60%
Loading events...
Reconnaissance b89ca49c7c23 newark_01 · 2026-08-23 17:40
1 1 60%
Loading events...
Reconnaissance 2b64ed961332 newark_01 · 2026-08-12 08:03
1 1 60%
Loading events...
Credential Probe 2ef74693c56c newark_01 · 2026-08-12 08:03
1 20%
Loading events...
Credential Probe 64fd61b5d5ac newark_01 · 2026-08-08 18:06
1 20%
Loading events...
Reconnaissance ad413317c3e4 newark_01 · 2026-08-08 17:35
1 1 60%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}