IntrusionLabs IntrusionLabs
← Back to feed

91.230.168.55

KNOWN SCANNER TAGGED BENIGN how we decide →
Why: Known research scanner (ONYPHE), inside the IP ranges it publishes
szymon.probe.onyphe.net (onyphe.net) ✓ FCrDNS
Threat Confidence
10%
Assessment
Port and service scanner
  • Part of a 17-IP campaign from the same subnet.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US / Hillsboro
ASN
AS213412 · ONYPHE SAS
Cloud Provider
—
Scanner Organization
ONYPHE
per its published IP ranges
Total Events
5
Below average by volume
Agent Count
1
First / Last Seen
2026-10-06 09:32 — 2026-10-06 09:32
Attack Types
ssh:connection
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Discovery
T1046
External Corroboration
Not flagged by any external feeds
Campaigns
Subnet 91.230.168.0/24 SUBNET Active high 🇺🇸 US
17 IPs 77 events
http:scanssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection
2026-02-18 — ongoing · 17 IPs from the same /24 subnet (91.230.168.0/24) were observed attacking our sensors within the same time window. …
Session Forensics
scanner ×2
Sessions
2
Avg Depth Score
0.15
Commands Executed
0
Files Downloaded
0
Fingerprints
1 SSH client banner · 0 HASSH fingerprints
SSH Client
b^\xa9\xfa/\xf7\xec\xda\xd8\xfe"\xbc\xe4\xf1\xdd\xef\xc3-!\xe3\xd7\xc2~4\xe9+c\xb9\xda\xf6\xa2 \xd2\xfc2!N=8\xe6\xdb\xed|0>\xc3\xeb\xce\xdf\xd98r ri\x99ݠd\xb3\x8a3g\xc0\x9e\xc0\xa2\x9e9k\xc0\x9f\xc0\xa3\x9fE\xbe\x88\xc4\x9a\xc0\xc0 \xc0#\xc0\xac\xc0\xae\xc0+\xc0
Evidence Timeline
Scanner 391e158baafd newark_01 · 2026-10-06 09:32
15%
Loading events...
Scanner 8b3d770b1ecc newark_01 · 2026-10-06 09:32
15%
Loading events...