← Back to feed
HASSH af8223ac9914… — SSH-2.0-libssh_0.12.0 (50 IPs, 19 countries)
HASSH Active highWhy this campaign was detected
50 IPs are running an identical SSH client (HASSH fingerprint af8223ac9914…). Top network: Microsoft Corporation (AS8075). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS8075 · Microsoft Corporation
Subnet
—
HASSH Fingerprint
Country
🇨🇳 CN
Cloud Provider
Azure
Member Count
50 IPs
Average
Total Events
20418
Below average by volume
Started / Ended
2026-02-28 09:17 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Command and Control
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 107.180.88.176 | credential_harvester | 83% | 1x OSINT | 4791 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | 176.88.180.107.host.secureserver.net | 2026-10-18 15:52 | evidence → |
| 172.174.5.146 | credential_harvester | 81% | 1x OSINT | 3207 | 3 | ssh:bruteforcessh:intrusionssh:malware | — | 2026-10-17 08:52 | evidence → |
| 163.7.1.218 | credential_harvester | 79% | 1x OSINT | 2247 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-16 13:57 | evidence → |
| 103.176.20.115 | credential_harvester | 77% | 1x OSINT | 3297 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-15 08:26 | evidence → |
| 61.76.136.25 | credential_harvester | 76% | 861 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-17 17:30 | evidence → | |
| 183.94.33.245 | scanner | 76% | 1x OSINT | 179 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-16 07:11 | evidence → |
| 14.103.103.211 | credential_harvester | 74% | 248 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-17 11:34 | evidence → | |
| 109.91.4.177 | credential_harvester | 71% | 1x OSINT | 4169 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | ip-109-091-004-177.um37.pools.vodafone-ip.de | 2026-09-24 05:00 | evidence → |
| 202.51.214.98 | credential_harvester | 71% | 1x OSINT | 3306 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-11 09:26 | evidence → |
| 103.187.165.26 | credential_harvester | 71% | 1x OSINT | 2312 | 3 | ssh:bruteforcessh:connectionssh:malware | host-103-187-165-26.taranet.id | 2026-10-11 16:21 | evidence → |
| 52.187.9.8 | credential_harvester | 71% | 1x OSINT | 1833 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-10-10 21:58 | evidence → |
| 203.83.231.93 | scanner | 70% | 1x OSINT | 573 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-03 23:44 | evidence → |
| 197.153.57.103 | credential_harvester | 67% | 4158 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-08-28 17:17 | evidence → | |
| 203.116.129.55 | credential_harvester | 67% | 4136 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | d129055.ppp129.cyberway.com.sg | 2026-08-19 05:39 | evidence → | |
| 4.221.162.168 | credential_harvester | 67% | 3680 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-09-24 23:51 | evidence → | |
| 52.177.169.196 | credential_harvester | 67% | 3503 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-09-09 20:20 | evidence → | |
| 112.120.171.95 | credential_harvester | 67% | 3463 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | n112120171095.netvigator.com | 2026-08-31 18:31 | evidence → | |
| 212.115.54.84 | credential_harvester | 67% | DROP | 3004 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-06-29 18:47 | evidence → |
| 161.35.205.74 | credential_harvester | 67% | 2502 | 3 | ssh:bruteforcessh:malware | — | 2026-08-14 01:43 | evidence → | |
| 102.210.149.236 | credential_harvester | 67% | 2317 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-07-22 01:51 | evidence → | |
| 20.49.0.100 | credential_harvester | 67% | 1849 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-07-16 01:04 | evidence → | |
| 45.78.194.242 | credential_harvester | 67% | 1656 | 3 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-08-05 20:03 | evidence → | |
| 151.80.141.196 | credential_harvester | 67% | 1190 | 3 | ssh:bruteforcessh:connectionssh:malware | 196.ip-151-80-141.eu | 2026-07-05 06:09 | evidence → | |
| 209.99.189.174 | credential_harvester | 67% | DROP | 1076 | 3 | ssh:bruteforcessh:malware | — | 2026-06-12 03:53 | evidence → |
| 78.83.249.54 | credential_harvester | 66% | 970 | 3 | ssh:bruteforcessh:connectionssh:malware | 78-83-249-54.spectrumnet.bg | 2026-05-30 15:55 | evidence → | |
| 160.174.129.232 | credential_harvester | 66% | 840 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-08-01 18:40 | evidence → | |
| 14.63.198.239 | credential_harvester | 66% | 725 | 3 | ssh:bruteforcessh:malware | — | 2026-06-19 07:14 | evidence → | |
| 125.21.53.232 | credential_harvester | 65% | 560 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-06-15 21:14 | evidence → | |
| 196.0.242.54 | credential_harvester | 65% | 454 | 3 | ssh:bruteforcessh:connectionssh:malware | speedtest.utclonline.co.ug | 2026-07-01 19:01 | evidence → | |
| 46.6.125.137 | credential_harvester | 64% | 312 | 3 | ssh:bruteforcessh:malware | — | 2026-05-25 13:11 | evidence → | |
| 95.165.77.31 | credential_harvester | 64% | 298 | 3 | ssh:bruteforcessh:connectionssh:malware | 95-165-77-31.dynamic.spd-mgts.ru | 2026-08-01 00:15 | evidence → | |
| 14.103.112.116 | scanner | 64% | 178 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-07-05 04:39 | evidence → | |
| 120.48.33.21 | scanner | 62% | 91 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-06-09 19:04 | evidence → | |
| 14.103.95.175 | scanner | 62% | 80 | 3 | ssh:bruteforcessh:connectionssh:malware | — | 2026-08-04 05:08 | evidence → | |
| 42.51.40.180 | credential_harvester | 54% | 1x OSINT | 292 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-10-02 01:45 | evidence → |
| 180.243.253.189 | credential_harvester | 49% | 188 | 2 | ssh:bruteforcessh:malware | — | 2026-05-30 16:46 | evidence → | |
| 118.145.111.33 | scanner | 47% | 61 | 2 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-07-07 23:17 | evidence → | |
| 123.121.210.115 | scanner | 45% | 23 | 2 | ssh:connectionssh:malware | — | 2026-05-27 10:27 | evidence → | |
| 171.244.185.149 | credential_harvester | 45% | 1x OSINT | 203 | 1 | ssh:bruteforcessh:malware | — | 2026-05-25 07:22 | evidence → |
| 106.13.239.146 | scanner | 40% | 179 | 1 | ssh:bruteforcessh:connectionssh:intrusionssh:malware | — | 2026-06-15 18:27 | evidence → | |
| 152.89.239.64 | credential_harvester | 39% | 170 | 1 | ssh:bruteforcessh:connectionssh:malware | — | 2026-05-28 06:44 | evidence → | |
| 122.51.73.24 | credential_harvester | 39% | 145 | 1 | ssh:bruteforcessh:malware | — | 2026-05-27 22:31 | evidence → | |
| 151.19.142.7 | credential_harvester | 38% | 84 | 1 | ssh:bruteforcessh:malware | — | 2026-05-27 18:17 | evidence → | |
| 203.195.64.232 | scanner | 38% | 72 | 1 | ssh:bruteforcessh:connectionssh:malware | — | 2026-05-31 12:39 | evidence → | |
| 151.47.89.53 | opportunistic_bruter | 36% | 23 | 1 | ssh:bruteforcessh:malware | — | 2026-05-27 18:39 | evidence → | |
| 182.253.31.67 | malware_dropper | 36% | 23 | 1 | ssh:bruteforcessh:connectionssh:malware | — | 2026-05-25 07:41 | evidence → | |
| 151.46.213.168 | malware_dropper | 36% | 18 | 1 | ssh:bruteforcessh:malware | — | 2026-05-30 07:01 | evidence → | |
| 14.103.127.75 | scanner | 18% | 69 | 1 | ssh:bruteforcessh:connection | — | 2026-07-28 08:31 | evidence → | |
| 14.103.200.237 | credential_probe | 15% | 51 | 1 | ssh:bruteforcessh:malware | — | 2026-05-28 21:09 | evidence → | |
| 151.43.101.231 | credential_probe | 14% | 38 | 1 | ssh:bruteforcessh:malware | — | 2026-05-27 18:35 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds