← Back to feed
64.62.197.225
KNOWN SCANNER TAGGED BENIGN how we decide →
Why: Known research scanner (Shadowserver Foundation)
scan-43n.shadowserver.io
(shadowserver.io)
✓ FCrDNS
Assessment
Port and service scanner
- Active for 10 days, 2026-10-05 to 2026-10-16.
- Part of a 105-IP scanning campaign.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US
ASN
AS6939 · Hurricane Electric LLC
Cloud Provider
—
Scanner Organization
Shadowserver Foundation
Total Events
8
Average by volume
Agent Count
1
First / Last Seen
2026-10-05 07:07 — 2026-10-16 06:41
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Not flagged by any external feeds
Campaigns
Shadowserver Foundation
SCANNER
Active
high
🇺🇸 US
105 IPs
5002 events
http:scanssh:bruteforcessh:connectionssh:intrusiontelnet:bruteforcetelnet:connectiontelnet:intrusion
2026-02-23 — ongoing
Subnet 64.62.197.0/24
SUBNET
Active
high
🇺🇸 US
8 IPs
119 events
http:scanssh:connectiontelnet:connection
2026-02-18 — ongoing · 8 IPs from the same /24 subnet (64.62.197.0/24) were observed attacking our sensors within the same time window. …
Session Forensics
Sessions
2
Avg Depth Score
0.15
Commands Executed
0
Files Downloaded
0
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
SSH Client
Evidence Timeline