← Back to feed
HASSH 19532158b559… — SSH-2.0-libssh2_1.11.1 (50 IPs, 19 countries)
HASSH Active highWhy this campaign was detected
50 IPs are running an identical SSH client (HASSH fingerprint 19532158b559…). Top network: UCLOUD INFORMATION TECHNOLOGY HK LIMITED (AS135377). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS135377 · UCLOUD INFORMATION TECHNOLOGY HK LIMITED
Subnet
—
HASSH Fingerprint
Country
🇺🇸 US
Cloud Provider
DO
Member Count
50 IPs
Average
Total Events
1312
Below average by volume
Started / Ended
2026-02-22 21:16 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Discovery
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 45.43.37.254 | credential_harvester | 68% | 3x OSINT | 245 | 3 | ssh:bruteforce | — | 2026-08-27 20:15 | evidence → |
| 190.2.135.111 | credential_harvester | 56% | 1x OSINT | 155 | 3 | ssh:bruteforce | — | 2026-06-14 10:04 | evidence → |
| 89.185.81.112 | credential_harvester | 56% | 1x OSINT | 150 | 3 | ssh:bruteforce | — | 2026-06-02 02:54 | evidence → |
| 172.245.16.13 | credential_harvester | 55% | 1x OSINT | 130 | 3 | ssh:bruteforce | — | 2026-05-22 04:34 | evidence → |
| 125.20.210.182 | credential_harvester | 55% | 1x OSINT | 105 | 3 | ssh:bruteforce | — | 2026-06-29 19:38 | evidence → |
| 152.32.132.28 | credential_harvester | 55% | 1x OSINT | 94 | 3 | ssh:bruteforce | — | 2026-06-09 00:29 | evidence → |
| 152.32.226.205 | credential_harvester | 55% | 1x OSINT | 89 | 3 | ssh:bruteforce | — | 2026-05-29 14:54 | evidence → |
| 152.32.192.176 | credential_harvester | 55% | 1x OSINT | 84 | 3 | ssh:bruteforce | — | 2026-06-01 21:47 | evidence → |
| 147.45.50.147 | credential_harvester | 54% | 1x OSINT | 65 | 3 | ssh:bruteforce | — | 2026-06-06 18:17 | evidence → |
| 210.211.122.97 | credential_harvester | 54% | 1x OSINT | 60 | 3 | ssh:bruteforce | — | 2026-08-08 18:47 | evidence → |
| 38.12.31.247 | credential_harvester | 54% | 1x OSINT | 54 | 3 | ssh:bruteforce | — | 2026-05-19 10:14 | evidence → |
| 152.32.174.171 | credential_harvester | 51% | 138 | 3 | ssh:bruteforce | — | 2026-08-07 07:27 | evidence → | |
| 167.172.152.94 | credential_harvester | 50% | 110 | 3 | ssh:bruteforce | — | 2026-06-28 13:54 | evidence → | |
| 209.99.185.239 | scanner | 48% | DROP | 39 | 3 | ssh:bruteforce | — | 2026-07-18 00:21 | evidence → |
| 118.194.235.105 | credential_harvester | 41% | 44 | 3 | ssh:bruteforce | — | 2026-07-19 14:50 | evidence → | |
| 165.154.20.228 | credential_harvester | 38% | 1x OSINT | 45 | 2 | ssh:bruteforce | — | 2026-05-31 21:03 | evidence → |
| 41.63.63.211 | credential_probe | 31% | 2x OSINT | 20 | 2 | ssh:bruteforce | — | 2026-08-19 12:11 | evidence → |
| 79.72.91.88 | credential_probe | 28% | 1x OSINT | 30 | 2 | ssh:bruteforce | — | 2026-05-19 22:31 | evidence → |
| 216.57.110.81 | credential_probe | 28% | 1x OSINT | 30 | 2 | ssh:bruteforce | — | 2026-07-10 19:08 | evidence → |
| 156.245.207.80 | credential_probe | 27% | DROP1x OSINT | 23 | 2 | ssh:bruteforce | — | 2026-05-24 10:25 | evidence → |
| 120.48.75.127 | scanner | 25% | 22 | 2 | ssh:bruteforce | — | 2026-06-27 06:03 | evidence → | |
| 77.68.25.99 | scanner | 23% | 8 | 2 | ssh:bruteforce | — | 2026-05-22 22:50 | evidence → | |
| 89.116.24.112 | opportunistic_bruter | 23% | 15 | 1 | ssh:bruteforce | — | 2026-05-23 17:03 | evidence → | |
| 162.198.46.77 | opportunistic_bruter | 23% | 15 | 1 | ssh:bruteforce | — | 2026-05-25 02:14 | evidence → | |
| 103.118.28.17 | credential_probe | 23% | 23 | 2 | ssh:bruteforce | — | 2026-05-24 12:14 | evidence → | |
| 38.77.249.41 | credential_probe | 22% | 20 | 2 | ssh:bruteforce | — | 2026-05-18 23:54 | evidence → | |
| 209.99.184.233 | scanner | 22% | DROP | 8 | 2 | ssh:bruteforce | — | 2026-05-24 23:47 | evidence → |
| 216.250.116.225 | credential_probe | 21% | 10 | 2 | ssh:bruteforce | — | 2026-05-21 16:35 | evidence → | |
| 107.155.48.46 | scanner | 21% | 1x OSINT | 22 | 1 | ssh:bruteforce | — | 2026-08-12 15:36 | evidence → |
| 130.61.24.69 | credential_probe | 17% | 1x OSINT | 10 | 1 | ssh:bruteforce | — | 2026-05-19 05:34 | evidence → |
| 2.26.98.173 | credential_probe | 17% | 1x OSINT | 10 | 1 | ssh:bruteforce | — | 2026-05-22 11:18 | evidence → |
| 98.172.97.239 | scanner | 17% | 1x OSINT | 4 | 1 | ssh:bruteforce | — | 2026-05-19 12:00 | evidence → |
| 162.141.0.211 | scanner | 14% | 8 | 1 | ssh:bruteforce | — | 2026-05-22 08:12 | evidence → | |
| 160.30.172.107 | credential_probe | 13% | 20 | 1 | ssh:bruteforce | — | 2026-05-20 19:50 | evidence → | |
| 2.27.44.191 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-19 22:38 | evidence → | |
| 138.252.100.168 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-21 19:57 | evidence → | |
| 64.110.88.6 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-21 10:27 | evidence → | |
| 86.53.186.162 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-19 19:46 | evidence → | |
| 2.27.22.122 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-23 14:47 | evidence → | |
| 103.119.18.191 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-23 04:19 | evidence → | |
| 144.31.147.243 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-23 19:33 | evidence → | |
| 86.48.0.8 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-20 17:13 | evidence → | |
| 216.144.224.186 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-23 10:52 | evidence → | |
| 102.203.200.175 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-22 07:36 | evidence → | |
| 137.131.194.173 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-25 11:36 | evidence → | |
| 185.113.10.179 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-18 20:09 | evidence → | |
| 23.94.213.157 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-20 02:19 | evidence → | |
| 168.138.232.38 | credential_probe | 13% | 15 | 1 | ssh:bruteforce | — | 2026-05-24 22:25 | evidence → | |
| 117.72.65.215 | scanner | 12% | 4 | 1 | ssh:bruteforce | — | 2026-05-21 23:41 | evidence → | |
| 51.68.186.168 | credential_probe | 11% | 5 | 1 | ssh:bruteforce | — | 2026-05-24 11:00 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds