← Back to feed
77.91.71.91
TAGGED SUSPICIOUS how we decide →
Why: Scanned our network, then came back as a credential harvester · certainty: inferred
Assessment
SSH password brute-forcer
- Active for 11 days, 2026-10-02 to 2026-10-14.
- Runs the same SSH client fingerprint (HASSH) as 120 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇷🇺 RU
ASN
AS211486 · Alferov Aleksey Aleksandrovich
Cloud Provider
—
Total Events
4722
Top 1% by volume
Agent Count
1
First / Last Seen
2026-10-02 12:32 — 2026-10-14 01:25
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Blocklist.de
blocklist_de:reported
Campaigns
Subnet 77.91.71.0/24
SUBNET
Active
high
🇷🇺 RU
3 IPs
1855 events
http:scanssh:bruteforcessh:connection
2026-09-24 — ongoing · 3 IPs from the same /24 subnet (77.91.71.0/24) were observed attacking our sensors within the same time window. …
HASSH 0a07365cc01f… — SSH-2.0-Go (121 IPs, 16 countries)
HASSH
Active
high
🇧🇬 BG
121 IPs
1921527 events
ftp:bruteforcessh:bruteforcessh:connectionssh:intrusiontelnet:bruteforcetelnet:connection
2026-02-22 — ongoing · 121 IPs are running an identical SSH client (HASSH fingerprint 0a07365cc01f…). Top network: TechTies Inc. (AS197170). Geographic and …
Session Forensics
Sessions
945
Avg Depth Score
0.2
Commands Executed
0
Files Downloaded
0
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
SSH Client
Evidence Timeline