IntrusionLabs IntrusionLabs
← Back to feed

64.62.156.80

TAGGED SUSPICIOUS how we decide →
Threat Confidence
42%
Location
🇺🇸 US / Minneapolis
ASN
AS6939 · Hurricane Electric LLC
Cloud Provider
—
Total Events
8
Below average by volume
Agent Count
1
First / Last Seen
2026-03-04 10:43 — 2026-04-29 04:59
Attack Types
http:scan ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1190
Credential Access
T1110 T1110.001
Discovery
T1046
External Corroboration
DShield Top Attackers
Reported 2026-04-29 08:01
dshield:top_attacker
Campaigns
Multi-Agent Scan SCAN Active medium
58 IPs 20671 events
2026-04-27 — ongoing · 58 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
111 IPs 347494 events
2026-03-13 — ongoing · 111 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
80 IPs 338654 events
2026-03-13 — ongoing · 80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
81 IPs 341143 events
2026-03-13 — ongoing · 81 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
64 IPs 9280 events
2026-03-12 — ongoing · 64 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
80 IPs 340026 events
2026-03-04 — ongoing · 80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
55 IPs 244260 events
2026-02-28 — ongoing · 55 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
26 IPs 12021 events
2026-02-22 — ongoing · 26 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Subnet 64.62.156.0/24 SUBNET Active high 🇺🇸 US
13 IPs 95 events
http:scanssh:bruteforce
2026-02-17 — ongoing · 13 IPs from the same /24 subnet (64.62.156.0/24) were observed attacking our sensors within the same time window. …
Session Forensics
scanner ×3 web_probe ×2
Sessions
5
Avg Depth Score
0.19
Commands Executed
0
Files Downloaded
0
Fingerprints
SSH Client
{w L\xe6\xf1\xbb\xd2a\xfcV7͉\xd4\xe8\x87jh\xab\xff\x94\xa5\xc4\xff}iz\xcam1\xa6\xc0/\xc0+\xc0\xc0\xc0\xc0 \xc0\xc0{wZ@zf\xadK\xbf\xbf\xbe\xcap\xd0\xddUY\xe9\xfey\xebg\x99\xac\xa5z\x9ck\xf4{\xc0/\xc0+\xc0\xc0\xc0\xc0 \xc0\xc0GET / HTTP/1.1
Evidence Timeline
Web Probe 414cc170f3cd492d w4m_singapore_01 · 2026-04-29 04:59
25%
Loading events...
Scanner af6165541fe1 newark_01 · 2026-04-27 03:58
15%
Loading events...
Scanner 082188335433 w4m_singapore_01 · 2026-04-05 03:54
15%
Loading events...
Web Probe 89320e46f35d491c w4m_singapore_01 · 2026-04-03 07:12
25%
Loading events...
Scanner 791bb9857125 w4m_singapore_01 · 2026-03-04 10:43
15%
Loading events...
Non-Session Events
Timestamp Port Proto Event Source Location
2026-04-29 04:59:39 :80 http HTTP GET request opencanary sin
2026-04-03 07:12:20 :80 http HTTP GET request opencanary sin