IntrusionLabs IntrusionLabs
← Back to feed

89.218.151.18

Threat Confidence
34%
Assessment
Post-login reconnaissance: logs in and surveys the host
  • Ran 2 commands on the host.
  • Runs the same SSH client fingerprint (HASSH) as 120 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇿 KZ / Shymkent
ASN
AS9198 · JSC Kazakhtelecom
Cloud Provider
—
Total Events
14
Average by volume
Agent Count
1
First / Last Seen
2026-10-17 00:28 — 2026-10-17 00:29
Attack Types
ssh:bruteforce ssh:intrusion
MITRE ATT&CK Techniques
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1082
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 0a07365cc01f… — SSH-2.0-Go (121 IPs, 16 countries) HASSH Active high 🇧🇬 BG
121 IPs 1921527 events
ftp:bruteforcessh:bruteforcessh:connectionssh:intrusiontelnet:bruteforcetelnet:connection
2026-02-22 — ongoing · 121 IPs are running an identical SSH client (HASSH fingerprint 0a07365cc01f…). Top network: TechTies Inc. (AS197170). Geographic and …
Session Forensics
reconnaissance ×1 opportunistic_bruter ×1
Sessions
2 (2 with login)
Avg Depth Score
0.55
Commands Executed
2
Files Downloaded
0
Notable Commands
  • echo "TEST"; echo -n "System :"; lsb_release -d | awk -F':' '{print " "$2}'; echo -n "Apt : "; which apt; echo -n "Cpu speed :"; cat /proc/cpuinfo | grep 'cpu MHz' | uniq | awk -F: '{printf " %.3f\n", $2}'; echo -n "Cpu count : "; nproc; echo -n "Memory : "; free -h | awk '/Mem:/ {print $2}'
  • lsb_release -d
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
0a07365cc01fa9fc82608ba4019af499
SSH Client
SSH-2.0-Go
Evidence Timeline
Reconnaissance 43090a9caa9a w4m_singapore_01 · 2026-10-17 00:29
2 1 60%
Loading events...
Opportunistic Bruter 43b6a64780f9 w4m_singapore_01 · 2026-10-17 00:28
1 50%
Loading events...