IntrusionLabs IntrusionLabs
← Back to feed

94.23.66.112

Threat Confidence
25%
Location
🇫🇷 FR
ASN
AS16276 · OVH SAS
Cloud Provider
—
Total Events
45
Average by volume
Agent Count
1
First / Last Seen
2026-08-23 19:12 — 2026-08-24 17:45
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Credential Access
T1110 T1110.001
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH 594c57870d0e… — SSH-2.0-Go (50 IPs, 15 countries) HASSH Ended high 🇺🇸 US
50 IPs 2275 events
ssh:bruteforce
2026-05-25 — ongoing · 50 IPs are running an identical SSH client (HASSH fingerprint 594c57870d0e…). Top network: OVH SAS (AS16276). Geographic and …
Session Forensics
credential_probe ×5 opportunistic_bruter ×4
Sessions
9 (4 with login)
Avg Depth Score
0.33
Commands Executed
0
Files Downloaded
0
Fingerprints
HASSH
51f27048cebcadb1f5a7c96f1154279c594c57870d0ec290ad3f328d5116eb185fdda8bdf7333bf9ab6e936370bcf9e0648ee2edc42931ec51095ae44e919a7677284974959de5948c0a0912565d213dae07bdc36018e5fda1d77fd0750d6ee7d62a846cbf57eb580b2c6d80cdd88191e9d7be42172423e459fe946d9370dccfedf1b2de2df3274f552def4d127aa33c
SSH Client
SSH-2.0-Go
Evidence Timeline
Opportunistic Bruter 1968aa837af6 newark_01 · 2026-08-24 17:45
1 50%
Loading events...
Credential Probe 999e64d8fa2e newark_01 · 2026-08-24 07:32
1 20%
Loading events...
Credential Probe 1442aa1aec6e newark_01 · 2026-08-24 04:43
1 20%
Loading events...
Credential Probe 82b8c0271131 newark_01 · 2026-08-24 03:55
1 20%
Loading events...
Credential Probe 7cd4a185cc84 newark_01 · 2026-08-24 01:08
1 20%
Loading events...
Credential Probe cb9d627b3c4d newark_01 · 2026-08-24 00:20
1 20%
Loading events...
Opportunistic Bruter afaf7e65d8ca newark_01 · 2026-08-23 21:38
1 50%
Loading events...
Opportunistic Bruter 83bb2a4f81f3 newark_01 · 2026-08-23 20:52
1 50%
Loading events...
Opportunistic Bruter 7888b2993e0a newark_01 · 2026-08-23 19:12
1 50%
Loading events...
{# Cloudflare Web Analytics — cookieless, public pages only. The context processor withholds the token from authenticated requests. #}