← Back to feed
HASSH af8223ac9914… — SSH-2.0-libssh_0.12.0 (50 IPs, 19 countries)
HASSH Active highWhy this campaign was detected
50 IPs are running an identical SSH client (HASSH fingerprint af8223ac9914…). Top network: Microsoft Corporation (AS8075). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS8075 · Microsoft Corporation
Subnet
—
HASSH Fingerprint
Country
🇨🇳 CN
Cloud Provider
Azure
Member Count
50 IPs
Average
Total Events
20418
Below average by volume
Started / Ended
2026-02-28 09:17 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Command and Control
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 107.180.88.176 | credential_harvester | 84% | 1x OSINT | 4244 | 3 | ssh:bruteforce | — | 2026-09-02 05:17 | evidence → |
| 52.187.9.8 | credential_harvester | 82% | 2x OSINT | 1548 | 3 | ssh:bruteforce | — | 2026-08-30 11:58 | evidence → |
| 197.153.57.103 | credential_harvester | 75% | 1x OSINT | 4158 | 3 | ssh:bruteforce | — | 2026-08-28 17:17 | evidence → |
| 112.120.171.95 | credential_harvester | 75% | 2x OSINT | 2763 | 3 | ssh:bruteforce | — | 2026-08-25 07:21 | evidence → |
| 203.83.231.93 | scanner | 74% | 2x OSINT | 544 | 3 | ssh:bruteforce | — | 2026-08-08 12:37 | evidence → |
| 103.187.165.26 | credential_harvester | 73% | 1x OSINT | 1752 | 3 | ssh:bruteforce | host-103-187-165-26.taranet.id | 2026-08-27 08:21 | evidence → |
| 203.116.129.55 | credential_harvester | 71% | 1x OSINT | 4136 | 3 | ssh:bruteforce | d129055.ppp129.cyberway.com.sg | 2026-08-19 05:39 | evidence → |
| 4.221.162.168 | credential_harvester | 71% | 1x OSINT | 3047 | 3 | ssh:bruteforce | — | 2026-08-22 10:42 | evidence → |
| 212.115.54.84 | credential_harvester | 71% | DROP1x OSINT | 3004 | 3 | ssh:bruteforce | — | 2026-06-29 18:47 | evidence → |
| 109.91.4.177 | credential_harvester | 71% | 1x OSINT | 2881 | 3 | ssh:bruteforce | ip-109-091-004-177.um37.pools.vodafone-ip.de | 2026-07-19 20:30 | evidence → |
| 103.176.20.115 | credential_harvester | 71% | 1x OSINT | 2452 | 3 | ssh:bruteforce | — | 2026-08-24 13:49 | evidence → |
| 102.210.149.236 | credential_harvester | 71% | 1x OSINT | 2317 | 3 | ssh:bruteforce | — | 2026-07-22 01:51 | evidence → |
| 52.177.169.196 | credential_harvester | 71% | 1x OSINT | 2157 | 3 | ssh:bruteforce | — | 2026-06-26 09:54 | evidence → |
| 202.51.214.98 | credential_harvester | 71% | 1x OSINT | 1701 | 3 | ssh:bruteforce | — | 2026-08-20 11:22 | evidence → |
| 45.78.194.242 | credential_harvester | 71% | 1x OSINT | 1656 | 3 | ssh:bruteforce | — | 2026-08-05 20:03 | evidence → |
| 151.80.141.196 | credential_harvester | 71% | 1x OSINT | 1190 | 3 | ssh:bruteforce | 196.ip-151-80-141.eu | 2026-07-05 06:09 | evidence → |
| 163.7.1.218 | credential_harvester | 71% | 1x OSINT | 1140 | 3 | ssh:bruteforce | — | 2026-07-29 04:15 | evidence → |
| 209.99.189.174 | credential_harvester | 71% | DROP1x OSINT | 1076 | 3 | ssh:bruteforce | — | 2026-06-12 03:53 | evidence → |
| 78.83.249.54 | credential_harvester | 71% | 1x OSINT | 970 | 3 | ssh:bruteforce | — | 2026-05-30 15:55 | evidence → |
| 160.174.129.232 | credential_harvester | 71% | 1x OSINT | 840 | 3 | ssh:bruteforce | — | 2026-08-01 18:40 | evidence → |
| 14.63.198.239 | credential_harvester | 71% | 1x OSINT | 725 | 3 | ssh:bruteforce | — | 2026-06-19 07:14 | evidence → |
| 125.21.53.232 | credential_harvester | 70% | 1x OSINT | 560 | 3 | ssh:bruteforce | — | 2026-06-15 21:14 | evidence → |
| 196.0.242.54 | credential_harvester | 70% | 1x OSINT | 454 | 3 | ssh:bruteforce | — | 2026-07-01 19:01 | evidence → |
| 14.103.103.211 | credential_harvester | 68% | 1x OSINT | 168 | 3 | ssh:bruteforce | — | 2026-08-05 05:53 | evidence → |
| 161.35.205.74 | credential_harvester | 67% | 2502 | 3 | ssh:bruteforce | — | 2026-08-14 01:43 | evidence → | |
| 20.49.0.100 | credential_harvester | 67% | 1849 | 3 | ssh:bruteforce | — | 2026-07-16 01:04 | evidence → | |
| 61.76.136.25 | credential_harvester | 66% | 823 | 3 | ssh:bruteforce | — | 2026-08-16 15:18 | evidence → | |
| 46.6.125.137 | credential_harvester | 64% | 312 | 3 | ssh:bruteforce | — | 2026-05-25 13:11 | evidence → | |
| 95.165.77.31 | credential_harvester | 64% | 298 | 3 | ssh:bruteforce | 95-165-77-31.dynamic.spd-mgts.ru | 2026-08-01 00:15 | evidence → | |
| 14.103.112.116 | scanner | 64% | 178 | 3 | ssh:bruteforce | — | 2026-07-05 04:39 | evidence → | |
| 183.94.33.245 | scanner | 63% | 151 | 3 | ssh:bruteforce | — | 2026-07-09 14:19 | evidence → | |
| 120.48.33.21 | scanner | 62% | 91 | 3 | ssh:bruteforce | — | 2026-06-09 19:04 | evidence → | |
| 14.103.95.175 | scanner | 62% | 80 | 3 | ssh:bruteforce | — | 2026-08-04 05:08 | evidence → | |
| 172.174.5.146 | credential_harvester | 56% | 1x OSINT | 2542 | 2 | ssh:bruteforce | — | 2026-08-25 17:58 | evidence → |
| 42.51.40.180 | credential_harvester | 49% | 285 | 2 | ssh:bruteforce | — | 2026-08-22 05:23 | evidence → | |
| 180.243.253.189 | credential_harvester | 49% | 188 | 2 | ssh:bruteforce | — | 2026-05-30 16:46 | evidence → | |
| 118.145.111.33 | scanner | 47% | 61 | 2 | ssh:bruteforce | — | 2026-07-07 23:17 | evidence → | |
| 123.121.210.115 | scanner | 45% | 23 | 2 | ssh:bruteforce | — | 2026-05-27 10:27 | evidence → | |
| 171.244.185.149 | credential_harvester | 40% | 203 | 1 | ssh:bruteforce | — | 2026-05-25 07:22 | evidence → | |
| 106.13.239.146 | scanner | 40% | 179 | 1 | ssh:bruteforce | — | 2026-06-15 18:27 | evidence → | |
| 152.89.239.64 | credential_harvester | 39% | 170 | 1 | ssh:bruteforce | — | 2026-05-28 06:44 | evidence → | |
| 122.51.73.24 | credential_harvester | 39% | 145 | 1 | ssh:bruteforce | — | 2026-05-27 22:31 | evidence → | |
| 151.19.142.7 | credential_harvester | 38% | 84 | 1 | ssh:bruteforce | — | 2026-05-27 18:17 | evidence → | |
| 203.195.64.232 | scanner | 38% | 72 | 1 | ssh:bruteforce | — | 2026-05-31 12:39 | evidence → | |
| 182.253.31.67 | malware_dropper | 36% | 23 | 1 | ssh:bruteforce | — | 2026-05-25 07:41 | evidence → | |
| 151.47.89.53 | opportunistic_bruter | 36% | 23 | 1 | ssh:bruteforce | — | 2026-05-27 18:39 | evidence → | |
| 151.46.213.168 | malware_dropper | 36% | 18 | 1 | ssh:bruteforce | — | 2026-05-30 07:01 | evidence → | |
| 14.103.127.75 | scanner | 18% | 69 | 1 | ssh:bruteforce | — | 2026-07-28 08:31 | evidence → | |
| 14.103.200.237 | credential_probe | 15% | 51 | 1 | ssh:bruteforce | — | 2026-05-28 21:09 | evidence → | |
| 151.43.101.231 | credential_probe | 14% | 38 | 1 | ssh:bruteforce | — | 2026-05-27 18:35 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds