← Back to feed
HASSH e54ef3ec27fe… — SSH-2.0-Go (50 IPs, 9 countries)
HASSH Active highWhy this campaign was detected
50 IPs are running an identical SSH client (HASSH fingerprint e54ef3ec27fe…). Top network: Microsoft Corporation (AS8075). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS8075 · Microsoft Corporation
Subnet
—
HASSH Fingerprint
Country
🇺🇸 US
Cloud Provider
Azure
Member Count
50 IPs
Average
Total Events
55225
Average by volume
Started / Ended
2026-02-22 16:58 — ongoing
Attack Types
MITRE ATT&CK Techniques
Execution
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 192.248.150.180 | web_probe | 75% | 2x OSINT | 478 | 4 | http:scanssh:connection | 192.248.150.180.vultrusercontent.com | 2026-10-18 14:48 | evidence → |
| 45.77.61.56 | scanner | 74% | 2x OSINT | 242 | 4 | http:scanssh:connection | 45.77.61.56.vultrusercontent.com | 2026-10-18 21:29 | evidence → |
| 45.63.4.69 | scanner | 74% | 2x OSINT | 339 | 4 | http:scanssh:connection | 45.63.4.69.vultrusercontent.com | 2026-10-18 11:26 | evidence → |
| 83.168.110.251 | credential_harvester | 70% | 1x OSINT | 29470 | 4 | ssh:bruteforcessh:connectionssh:intrusion | KeyHost.GG | 2026-10-17 04:50 | evidence → |
| 165.154.137.186 | credential_harvester | 64% | 1x OSINT | 11145 | 4 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-13 17:09 | evidence → |
| 135.148.217.213 | credential_harvester | 60% | 8812 | 3 | ssh:bruteforcessh:connectionssh:intrusion | ip213.ip-135-148-217.us | 2026-10-13 23:26 | evidence → | |
| 107.175.54.35 | scanner | 52% | 1x OSINT | 12 | 3 | ssh:connection | 107-175-54-35-host.colocrossing.com | 2026-10-17 05:01 | evidence → |
| 167.99.207.13 | scanner | 50% | 40 | 4 | ssh:connection | — | 2026-10-17 21:50 | evidence → | |
| 176.65.149.188 | scanner | 47% | DROP | 22 | 4 | ssh:connectiontelnet:connection | 176.65.149.188.ptr.pfcloud.network | 2026-10-10 09:11 | evidence → |
| 174.138.47.77 | scanner | 43% | 16 | 4 | ssh:connection | — | 2026-10-15 03:16 | evidence → | |
| 104.152.52.203 | scanner | 42% | 18 | 3 | ssh:connection | internettl.org | 2026-10-14 07:43 | evidence → | |
| 20.169.56.8 | scanner | 40% | 1x OSINT | 8 | 2 | ssh:connectiontelnet:connection | — | 2026-10-15 06:42 | evidence → |
| 43.225.91.19 | credential_harvester | 39% | 1x OSINT | 511 | 1 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-14 02:42 | evidence → |
| 40.124.179.181 | scanner | 38% | 1x OSINT | 11 | 2 | ssh:connectiontelnet:connection | — | 2026-10-13 22:48 | evidence → |
| 134.33.67.105 | scanner | 37% | 1x OSINT | 16 | 2 | ssh:connectiontelnet:connection | — | 2026-10-13 03:30 | evidence → |
| 8.219.91.192 | reconnaissance | 37% | 1x OSINT | 2466 | 1 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-11 05:16 | evidence → |
| 193.233.84.84 | reconnaissance | 36% | DROP | 2673 | 1 | ssh:bruteforcessh:connectionssh:intrusion | 176081.ip-ptr.tech | 2026-10-14 02:03 | evidence → |
| 40.124.117.15 | scanner | 35% | 1x OSINT | 11 | 2 | ssh:connectiontelnet:connection | — | 2026-10-11 10:11 | evidence → |
| 40.124.168.247 | scanner | 35% | 1x OSINT | 11 | 2 | ssh:connectiontelnet:connection | — | 2026-10-12 05:39 | evidence → |
| 8.219.65.17 | credential_harvester | 35% | 396 | 1 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-14 17:30 | evidence → | |
| 47.236.225.191 | credential_harvester | 33% | 576 | 1 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-13 00:17 | evidence → | |
| 104.152.52.149 | scanner | 31% | 22 | 2 | ssh:connection | internettl.org | 2026-10-16 04:16 | evidence → | |
| 20.98.152.40 | scanner | 31% | 11 | 2 | ssh:connectiontelnet:connection | — | 2026-10-10 11:13 | evidence → | |
| 178.128.205.47 | scanner | 23% | 8 | 2 | ssh:connection | ssh-scan-0.io.internetdata.io | 2026-10-13 01:39 | evidence → | |
| 20.83.60.78 | scanner | 23% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-15 06:41 | evidence → |
| 20.15.227.254 | scanner | 23% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-15 06:44 | evidence → |
| 20.98.162.154 | scanner | 23% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-15 06:40 | evidence → |
| 104.152.52.225 | scanner | 23% | 15 | 2 | ssh:connection | internettl.org | 2026-10-09 07:26 | evidence → | |
| 20.15.228.247 | scanner | 20% | 1x OSINT | 6 | 1 | ssh:connection | — | 2026-10-13 22:51 | evidence → |
| 20.98.162.172 | scanner | 20% | 1x OSINT | 4 | 1 | ssh:connection | — | 2026-10-13 22:51 | evidence → |
| 134.33.97.105 | scanner | 18% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-10 11:14 | evidence → |
| 20.168.122.37 | scanner | 18% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-08 18:56 | evidence → |
| 40.80.203.33 | scanner | 18% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-08 18:58 | evidence → |
| 20.171.13.9 | scanner | 18% | 1x OSINT | 7 | 1 | ssh:connection | — | 2026-10-10 11:13 | evidence → |
| 104.152.52.114 | scanner | 14% | 8 | 1 | ssh:connection | internettl.org | 2026-10-12 21:48 | evidence → | |
| 130.131.162.47 | scanner | 14% | 14 | 1 | ssh:connection | — | 2026-10-08 18:58 | evidence → | |
| 104.152.52.202 | scanner | 14% | 12 | 1 | ssh:connection | internettl.org | 2026-10-11 05:59 | evidence → | |
| 9.234.8.38 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-09 14:26 | evidence → | |
| 172.169.234.168 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-09 14:25 | evidence → | |
| 52.165.83.239 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-11 10:08 | evidence → | |
| 20.80.99.131 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-11 10:13 | evidence → | |
| 20.46.251.108 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-12 05:37 | evidence → | |
| 135.233.96.13 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-12 05:38 | evidence → | |
| 172.169.249.247 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-09 14:25 | evidence → | |
| 40.67.173.59 | scanner | 13% | 7 | 1 | ssh:connection | — | 2026-10-08 18:59 | evidence → | |
| 143.244.161.61 | scanner | 12% | 4 | 1 | ssh:connection | — | 2026-10-08 20:05 | evidence → | |
| 104.152.52.232 | scanner | 12% | 4 | 1 | ssh:connection | internettl.org | 2026-10-08 21:59 | evidence → | |
| 167.99.134.69 | scanner | 12% | 4 | 1 | ssh:connection | ssh-scan-0.io.internetdata.io | 2026-10-11 07:36 | evidence → | |
| 152.42.178.3 | scanner | 12% | 4 | 1 | ssh:connection | — | 2026-10-09 19:50 | evidence → | |
| 157.230.100.57 | scanner | 12% | 4 | 1 | ssh:connection | — | 2026-10-09 15:52 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds