← Back to feed

66.154.115.247

TAGGED SUSPICIOUS how we decide →

Threat Confidence

34%

Location

🇺🇸 US / Secaucus

ASN

AS7393 · CYBERCON, INC.

Cloud Provider

—

Total Events

Above average by volume

Agent Count

First / Last Seen

2026-08-06 10:11 — 2026-08-24 06:30

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1078

Credential Access

T1110 T1110.001

Discovery

T1016 T1046 T1082

External Corroboration

Blocklist.de

Reported 2026-09-01 10:01

blocklist_de:reported

Campaigns

HASSH a4bb6308c6d3… — SSH-2.0-Go (74 IPs, 22 countries) HASSH Ended high 🇩🇪 DE

74 IPs 2741 events

ssh:bruteforce

2026-08-03 — ongoing · 74 IPs are running an identical SSH client (HASSH fingerprint a4bb6308c6d3…). Top network: netcup GmbH (AS197540). Geographic and …

HASSH 8553d1d88514… — SSH-2.0-Go (50 IPs, 16 countries) HASSH Active high 🇺🇸 US

50 IPs 1466 events

ssh:bruteforce

2026-08-03 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 8553d1d88514…). Top network: Korea Telecom (AS4766). Geographic and …

Session Forensics

scanner ×3 reconnaissance ×3 credential_probe ×6 opportunistic_bruter ×5

Sessions

17 (8 with login)

Avg Depth Score

0.35

Commands Executed

Files Downloaded

Notable Commands

uname -a 2>/dev/null || echo 'Linux'
uname -a

Fingerprints

HASSH

1da5d2e7cc3a1857fec00ec5c4efde74 1e2e359ebffcbf4f8a7c14cd42fff5b8 3362745b18a73326b65fa9bb45f31319 492a707a14cf1018ec623157d78b76de 4ee726c9777241d10dda959b045f7ceb 671d9362bd477ace5bb43c7d918ff666 80d9e1d7a4faebe9cda3e69e3a839c6c 8553d1d88514650a5a38b12a50ec72df a4bb6308c6d3a1e3fe1a437ba6ba379a a98289aad12d4f01d91be47eac6010fa afa00db7b703fa5f0b50360401ca1042 c8d08ad20667b0a9bef78dd805a54233 f99f57552974927e55ab8dab201fdef0

SSH Client

SSH-2.0-Go

Evidence Timeline

Credential Probe b1d9637ec944 newark_01 · 2026-08-24 06:30

1 20%

Loading events...

Credential Probe c327dd2252f7 newark_01 · 2026-08-24 05:12

1 20%

Loading events...

Opportunistic Bruter 4baf67035110 newark_01 · 2026-08-24 03:42

1 50%

Loading events...

Opportunistic Bruter 813092faf3c0 newark_01 · 2026-08-24 02:25

1 50%

Loading events...

Opportunistic Bruter 50d1fc13a6e4 newark_01 · 2026-08-24 00:56

1 50%

Loading events...

Opportunistic Bruter 03de84547b68 newark_01 · 2026-08-23 23:40

1 50%

Loading events...

Credential Probe 5170a7580f33 newark_01 · 2026-08-23 22:11

1 20%

Loading events...

Credential Probe 6817c3c070e0 newark_01 · 2026-08-23 20:57

1 20%

Loading events...

Scanner bad86df034f3 newark_01 · 2026-08-23 18:39

15%

Loading events...

Reconnaissance 5e98009c9a91 newark_01 · 2026-08-11 12:35

1 1 60%

Loading events...

Opportunistic Bruter 959aa2f03a92 newark_01 · 2026-08-11 12:35

1 50%

Loading events...

Credential Probe 8a61130b42af newark_01 · 2026-08-08 18:17

1 20%

Loading events...

Reconnaissance 1a91511d00d6 newark_01 · 2026-08-08 17:55

1 1 60%

Loading events...

Credential Probe 8a0fef92620f newark_01 · 2026-08-07 17:39

1 20%

Loading events...

Scanner ef0091dd6e58 newark_01 · 2026-08-07 17:39

15%

Loading events...

Reconnaissance 1559ade761cc newark_01 · 2026-08-06 10:11

1 1 60%

Loading events...

Scanner 38bf8604e53e newark_01 · 2026-08-06 10:11

15%

Loading events...