IntrusionLabs IntrusionLabs
← Back to feed

89.163.206.150

Threat Confidence
29%
Location
🇩🇪 DE / Düsseldorf
ASN
AS24961 · WIIT AG
Cloud Provider
—
Total Events
130
Above average by volume
Agent Count
1
First / Last Seen
2026-08-03 21:23 — 2026-08-10 13:43
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH a4bb6308c6d3… — SSH-2.0-Go (74 IPs, 22 countries) HASSH Ended high 🇩🇪 DE
74 IPs 2741 events
ssh:bruteforce
2026-08-03 — ongoing · 74 IPs are running an identical SSH client (HASSH fingerprint a4bb6308c6d3…). Top network: netcup GmbH (AS197540). Geographic and …
HASSH 80d9e1d7a4fa… — SSH-2.0-Go (54 IPs, 18 countries) HASSH Ended high 🇩🇪 DE
54 IPs 1968 events
ssh:bruteforce
2026-05-23 — ongoing · 54 IPs are running an identical SSH client (HASSH fingerprint 80d9e1d7a4fa…). Top network: netcup GmbH (AS197540). Geographic and …
Session Forensics
scanner ×6 reconnaissance ×11 credential_probe ×6
Sessions
23 (11 with login)
Avg Depth Score
0.38
Commands Executed
11
Files Downloaded
0
Notable Commands
  • uname -a
Fingerprints
HASSH
80d9e1d7a4faebe9cda3e69e3a839c6ca4bb6308c6d3a1e3fe1a437ba6ba379a
SSH Client
SSH-2.0-Go
Evidence Timeline
Reconnaissance 8cf9ceb12e3f newark_01 · 2026-08-10 13:43
1 1 60%
Loading events...
Reconnaissance 806028336ec2 newark_01 · 2026-08-10 07:58
1 1 60%
Loading events...
Reconnaissance 2d084ef8c424 newark_01 · 2026-08-09 17:33
1 1 60%
Loading events...
Reconnaissance 011bc3a85474 newark_01 · 2026-08-09 12:56
1 1 60%
Loading events...
Credential Probe 295e1b1ced95 newark_01 · 2026-08-09 12:21
1 20%
Loading events...
Credential Probe 1daa80065e78 newark_01 · 2026-08-09 09:28
1 20%
Loading events...
Reconnaissance 223338fb4586 newark_01 · 2026-08-08 20:17
1 1 60%
Loading events...
Reconnaissance bc4f3c436830 newark_01 · 2026-08-08 19:08
1 1 60%
Loading events...
Reconnaissance 0417cb03d667 newark_01 · 2026-08-08 18:37
1 1 60%
Loading events...
Reconnaissance 12d61893ee15 newark_01 · 2026-08-08 18:10
1 1 60%
Loading events...
Credential Probe 6669c8f68de1 newark_01 · 2026-08-08 17:55
1 20%
Loading events...
Credential Probe 6346e0526a52 newark_01 · 2026-08-08 04:55
1 20%
Loading events...
Scanner af7ee86f7a50 newark_01 · 2026-08-08 04:55
15%
Loading events...
Reconnaissance 2973d2430f87 newark_01 · 2026-08-07 22:19
1 1 60%
Loading events...
Scanner 208a167d0644 newark_01 · 2026-08-07 22:19
15%
Loading events...
Credential Probe 87dd023b3e3b newark_01 · 2026-08-07 15:43
1 20%
Loading events...
Scanner 016e00a2f0bd newark_01 · 2026-08-07 15:43
15%
Loading events...
Reconnaissance c370705c31a2 newark_01 · 2026-08-06 08:46
1 1 60%
Loading events...
Scanner e254f4f83ce9 newark_01 · 2026-08-06 08:46
15%
Loading events...
Credential Probe 57f7d546cbf2 newark_01 · 2026-08-04 03:58
1 20%
Loading events...
Scanner 19b83504f9bc newark_01 · 2026-08-04 03:58
15%
Loading events...
Reconnaissance 6f3967940fd7 newark_01 · 2026-08-03 21:23
1 1 60%
Loading events...
Scanner 463e48021750 newark_01 · 2026-08-03 21:23
15%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}