← Back to feed
HASSH 98ddc5604ef6… — SSH-2.0-Go (52 IPs, 15 countries)
HASSH Active highWhy this campaign was detected
52 IPs are running an identical SSH client (HASSH fingerprint 98ddc5604ef6…). Top network: Chinanet (AS4134). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS4134 · Chinanet
Subnet
—
HASSH Fingerprint
Country
🇨🇳 CN
Cloud Provider
DO
Member Count
52 IPs
Average
Total Events
3923
Below average by volume
Started / Ended
2026-03-14 09:47 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Exfiltration
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 94.102.49.155 | mysql_bruter | 66% | DROP1x OSINT | 386 | 3 | ftp:bruteforcemysql:bruteforcessh:bruteforce | no-reverse-dns-configured.com | 2026-08-29 22:53 | evidence → |
| 110.173.190.221 | reconnaissance | 65% | 2x OSINT | 928 | 3 | ssh:bruteforce | — | 2026-08-20 05:59 | evidence → |
| 120.48.14.39 | scanner | 63% | 1x OSINT | 44 | 3 | ssh:bruteforce | — | 2026-08-22 01:30 | evidence → |
| 58.23.69.251 | data_exfiltrator | 62% | 1x OSINT | 21 | 3 | ssh:bruteforce | — | 2026-08-20 17:32 | evidence → |
| 101.206.211.72 | data_exfiltrator | 62% | 1x OSINT | 18 | 3 | ssh:bruteforce | — | 2026-08-19 02:28 | evidence → |
| 223.243.179.70 | data_exfiltrator | 62% | 1x OSINT | 18 | 3 | ssh:bruteforce | — | 2026-08-21 02:57 | evidence → |
| 14.17.59.195 | scanner | 51% | 30 | 2 | ssh:bruteforce | — | 2026-08-29 16:30 | evidence → | |
| 138.122.140.200 | data_exfiltrator | 47% | 1x OSINT | 18 | 2 | ssh:bruteforce | — | 2026-08-21 06:45 | evidence → |
| 120.92.210.214 | scanner | 47% | 1x OSINT | 18 | 2 | ssh:bruteforce | — | 2026-08-21 03:51 | evidence → |
| 124.123.125.62 | data_exfiltrator | 47% | 1x OSINT | 18 | 2 | ssh:bruteforce | — | 2026-08-16 06:18 | evidence → |
| 106.12.7.70 | data_exfiltrator | 47% | 1x OSINT | 14 | 2 | ssh:bruteforce | — | 2026-08-19 06:54 | evidence → |
| 119.97.184.93 | data_exfiltrator | 46% | 1x OSINT | 13 | 2 | ssh:bruteforce | — | 2026-08-20 07:39 | evidence → |
| 101.96.229.2 | data_exfiltrator | 46% | 1x OSINT | 12 | 2 | ssh:bruteforce | — | 2026-08-17 17:21 | evidence → |
| 60.173.164.3 | scanner | 43% | 28 | 2 | ssh:bruteforce | — | 2026-08-16 20:00 | evidence → | |
| 45.142.193.164 | reconnaissance | 41% | DROP2x OSINT | 1105 | 1 | ssh:bruteforce | — | 2026-08-17 02:07 | evidence → |
| 111.160.133.62 | data_exfiltrator | 38% | 1x OSINT | 14 | 1 | ssh:bruteforce | — | 2026-08-19 17:58 | evidence → |
| 14.18.41.55 | data_exfiltrator | 37% | 1x OSINT | 12 | 1 | ssh:bruteforce | — | 2026-08-21 09:13 | evidence → |
| 20.64.113.40 | data_exfiltrator | 37% | 1x OSINT | 12 | 1 | ssh:bruteforce | — | 2026-08-20 18:09 | evidence → |
| 199.195.252.227 | reconnaissance | 37% | 178 | 1 | ssh:bruteforce | — | 2026-08-29 07:40 | evidence → | |
| 192.252.215.125 | data_exfiltrator | 36% | 1x OSINT | 6 | 1 | ssh:bruteforce | — | 2026-08-18 03:24 | evidence → |
| 158.69.197.98 | data_exfiltrator | 36% | 1x OSINT | 6 | 1 | ssh:bruteforce | — | 2026-08-17 18:29 | evidence → |
| 106.12.15.118 | scanner | 36% | 37 | 2 | ssh:bruteforce | — | 2026-08-20 14:48 | evidence → | |
| 218.98.97.7 | data_exfiltrator | 32% | 8 | 1 | ssh:bruteforce | — | 2026-08-18 13:22 | evidence → | |
| 139.159.230.202 | data_exfiltrator | 32% | 8 | 1 | ssh:bruteforce | — | 2026-08-18 20:51 | evidence → | |
| 113.0.152.164 | data_exfiltrator | 31% | 6 | 1 | ssh:bruteforce | — | 2026-08-22 23:39 | evidence → | |
| 122.225.202.130 | data_exfiltrator | 31% | 6 | 1 | ssh:bruteforce | — | 2026-08-17 14:14 | evidence → | |
| 103.241.168.70 | data_exfiltrator | 31% | 6 | 1 | ssh:bruteforce | — | 2026-08-19 09:07 | evidence → | |
| 36.111.41.229 | data_exfiltrator | 31% | 6 | 1 | ssh:bruteforce | — | 2026-08-19 13:31 | evidence → | |
| 94.70.195.157 | data_exfiltrator | 31% | 6 | 1 | ssh:bruteforce | — | 2026-08-20 22:13 | evidence → | |
| 24.80.12.239 | reconnaissance | 31% | 168 | 1 | ssh:bruteforce | — | 2026-08-26 11:25 | evidence → | |
| 81.30.147.158 | reconnaissance | 29% | 160 | 1 | ssh:bruteforce | — | 2026-08-16 03:08 | evidence → | |
| 213.144.214.234 | reconnaissance | 28% | 64 | 1 | ssh:bruteforce | — | 2026-08-16 06:08 | evidence → | |
| 104.248.137.38 | reconnaissance | 28% | 64 | 1 | ssh:bruteforce | — | 2026-08-16 05:06 | evidence → | |
| 87.106.32.238 | reconnaissance | 27% | 40 | 1 | ssh:bruteforce | — | 2026-08-16 05:23 | evidence → | |
| 165.22.223.183 | reconnaissance | 27% | 32 | 1 | ssh:bruteforce | — | 2026-08-16 06:32 | evidence → | |
| 95.217.165.36 | reconnaissance | 27% | 32 | 1 | ssh:bruteforce | — | 2026-08-16 04:00 | evidence → | |
| 92.33.32.142 | reconnaissance | 27% | 32 | 1 | ssh:bruteforce | — | 2026-08-16 06:42 | evidence → | |
| 81.169.210.61 | reconnaissance | 27% | 32 | 1 | ssh:bruteforce | — | 2026-08-16 05:57 | evidence → | |
| 149.28.78.161 | reconnaissance | 27% | 32 | 1 | ssh:bruteforce | — | 2026-08-16 05:46 | evidence → | |
| 154.241.19.123 | opportunistic_bruter | 26% | 1x OSINT | 6 | 1 | ssh:bruteforce | — | 2026-08-18 06:28 | evidence → |
| 143.198.155.206 | reconnaissance | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-16 03:29 | evidence → | |
| 151.80.25.153 | reconnaissance | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-16 05:58 | evidence → | |
| 210.1.60.159 | reconnaissance | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-16 06:14 | evidence → | |
| 134.122.25.0 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-16 06:05 | evidence → | |
| 159.195.48.180 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-16 05:34 | evidence → | |
| 49.12.33.172 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-16 03:58 | evidence → | |
| 164.68.105.207 | reconnaissance | 24% | 8 | 1 | ssh:bruteforce | — | 2026-08-16 06:36 | evidence → | |
| 5.189.135.243 | reconnaissance | 24% | 8 | 1 | ssh:bruteforce | — | 2026-08-16 03:02 | evidence → | |
| 183.62.159.92 | opportunistic_bruter | 21% | 6 | 1 | ssh:bruteforce | — | 2026-08-18 18:08 | evidence → | |
| 185.74.59.11 | credential_harvester | 20% | 286 | 1 | ssh:bruteforce | — | 2026-08-16 19:21 | evidence → | |
| 213.5.130.217 | credential_probe | 16% | 1x OSINT | 5 | 1 | ssh:bruteforce | — | 2026-08-19 06:53 | evidence → |
| 8.133.188.11 | credential_probe | 12% | 10 | 1 | ssh:bruteforce | — | 2026-08-20 04:51 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds