← Back to feed
HASSH 98ddc5604ef6… — SSH-2.0-Go (52 IPs, 15 countries)
HASSH Active highWhy this campaign was detected
52 IPs are running an identical SSH client (HASSH fingerprint 98ddc5604ef6…). Top network: Chinanet (AS4134). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS4134 · Chinanet
Subnet
—
HASSH Fingerprint
Country
🇨🇳 CN
Cloud Provider
DO
Member Count
52 IPs
Average
Total Events
3923
Below average by volume
Started / Ended
2026-03-14 09:47 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Exfiltration
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 120.48.14.39 | scanner | 64% | 1x OSINT | 60 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-09-17 02:46 | evidence → |
| 124.123.125.62 | data_exfiltrator | 63% | 1x OSINT | 36 | 3 | ssh:bruteforcessh:intrusion | broadband.actcorp.in | 2026-09-25 07:34 | evidence → |
| 223.243.179.70 | data_exfiltrator | 62% | 1x OSINT | 18 | 3 | ssh:bruteforcessh:intrusion | — | 2026-08-21 02:57 | evidence → |
| 14.17.59.195 | scanner | 60% | 1x OSINT | 40 | 2 | ssh:connectionssh:intrusion | — | 2026-10-18 16:42 | evidence → |
| 58.23.69.251 | data_exfiltrator | 57% | 21 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-08-20 17:32 | evidence → | |
| 101.206.211.72 | data_exfiltrator | 57% | 18 | 3 | ssh:intrusion | — | 2026-08-19 02:28 | evidence → | |
| 45.142.193.164 | reconnaissance | 56% | DROP | 82805 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-09-13 16:10 | evidence → |
| 110.173.190.221 | reconnaissance | 56% | 928 | 3 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-08-20 05:59 | evidence → | |
| 94.102.49.155 | mysql_bruter | 53% | DROP | 408 | 3 | ftp:bruteforcemysql:bruteforcessh:connection | asm.group-ib.com | 2026-09-04 13:50 | evidence → |
| 199.195.252.227 | reconnaissance | 47% | 206 | 1 | ftp:bruteforcessh:bruteforcessh:intrusion | nj02.wrld3.net | 2026-09-25 00:55 | evidence → | |
| 24.80.12.239 | reconnaissance | 46% | 169 | 1 | ftp:bruteforcessh:intrusion | S0106a8637dbaa51a.vc.shawcable.net | 2026-09-15 13:59 | evidence → | |
| 101.96.229.2 | data_exfiltrator | 46% | 1x OSINT | 12 | 2 | ssh:intrusion | — | 2026-08-17 17:21 | evidence → |
| 210.1.60.159 | ftp_bruter | 46% | 59 | 1 | ftp:bruteforcessh:bruteforcessh:intrusion | mail.ngoenthai.co.th | 2026-10-12 18:13 | evidence → | |
| 213.144.214.234 | reconnaissance | 45% | 91 | 1 | ftp:bruteforcessh:bruteforcessh:intrusion | 234.214.144.213.rev.sfr.net | 2026-09-22 13:10 | evidence → | |
| 87.106.32.238 | ftp_bruter | 45% | 75 | 1 | ftp:bruteforcessh:bruteforcessh:intrusion | ip87-106-32-238.pbiaas.com | 2026-09-21 08:12 | evidence → | |
| 92.33.32.142 | ftp_bruter | 44% | 52 | 1 | ftp:bruteforcessh:bruteforcessh:intrusion | srlq.gigaeria.com | 2026-09-22 20:18 | evidence → | |
| 192.252.215.125 | data_exfiltrator | 44% | 12 | 1 | ssh:intrusion | — | 2026-10-18 09:17 | evidence → | |
| 60.173.164.3 | scanner | 43% | 28 | 2 | ssh:connectionssh:intrusion | — | 2026-08-16 20:00 | evidence → | |
| 119.97.184.93 | data_exfiltrator | 42% | 19 | 2 | ssh:bruteforcessh:connectionssh:intrusion | — | 2026-10-10 18:37 | evidence → | |
| 120.92.210.214 | scanner | 42% | 18 | 2 | ssh:connectionssh:intrusion | — | 2026-08-21 03:51 | evidence → | |
| 138.122.140.200 | data_exfiltrator | 42% | 18 | 2 | ssh:intrusion | 138-122-140-200.gruponetway.net.br | 2026-08-21 06:45 | evidence → | |
| 158.69.197.98 | data_exfiltrator | 42% | 18 | 2 | ssh:intrusion | vps-38ab5601.vps.ovh.ca | 2026-10-04 07:16 | evidence → | |
| 106.12.7.70 | data_exfiltrator | 42% | 14 | 2 | ssh:connectionssh:intrusion | — | 2026-08-19 06:54 | evidence → | |
| 103.241.168.70 | data_exfiltrator | 41% | 12 | 2 | ssh:intrusion | — | 2026-09-03 17:27 | evidence → | |
| 81.30.147.158 | reconnaissance | 38% | 160 | 1 | ssh:intrusion | — | 2026-08-16 03:08 | evidence → | |
| 111.160.133.62 | data_exfiltrator | 38% | 1x OSINT | 14 | 1 | ssh:connectionssh:intrusion | no-data | 2026-08-19 17:58 | evidence → |
| 113.0.152.164 | data_exfiltrator | 36% | 1x OSINT | 6 | 1 | ssh:intrusion | — | 2026-08-22 23:39 | evidence → |
| 106.12.15.118 | scanner | 36% | 37 | 2 | ssh:connectionssh:intrusion | — | 2026-08-20 14:48 | evidence → | |
| 143.198.155.206 | reconnaissance | 34% | 30 | 1 | ftp:bruteforcessh:bruteforcessh:intrusion | freeternity.com | 2026-09-21 22:12 | evidence → | |
| 134.122.25.0 | reconnaissance | 34% | 17 | 1 | ftp:bruteforcessh:intrusion | — | 2026-09-09 06:54 | evidence → | |
| 20.64.113.40 | data_exfiltrator | 32% | 12 | 1 | ssh:bruteforcessh:intrusion | — | 2026-08-20 18:09 | evidence → | |
| 122.225.202.130 | data_exfiltrator | 32% | 12 | 1 | ssh:intrusion | — | 2026-08-31 20:27 | evidence → | |
| 14.18.41.55 | data_exfiltrator | 32% | 12 | 1 | ssh:intrusion | — | 2026-08-21 09:13 | evidence → | |
| 218.98.97.7 | data_exfiltrator | 32% | 8 | 1 | ssh:connectionssh:intrusion | — | 2026-08-18 13:22 | evidence → | |
| 139.159.230.202 | data_exfiltrator | 32% | 8 | 1 | ssh:connectionssh:intrusion | — | 2026-08-18 20:51 | evidence → | |
| 94.70.195.157 | data_exfiltrator | 31% | 6 | 1 | ssh:intrusion | host13.ow1rdu.ondsl.gr | 2026-08-20 22:13 | evidence → | |
| 36.111.41.229 | data_exfiltrator | 31% | 6 | 1 | ssh:intrusion | — | 2026-08-19 13:31 | evidence → | |
| 104.248.137.38 | reconnaissance | 28% | 64 | 1 | ssh:intrusion | — | 2026-08-16 05:06 | evidence → | |
| 95.217.165.36 | reconnaissance | 27% | 32 | 1 | ssh:intrusion | static.36.165.217.95.clients.your-server.de | 2026-08-16 04:00 | evidence → | |
| 81.169.210.61 | reconnaissance | 27% | 32 | 1 | ssh:intrusion | h2779130.stratoserver.net | 2026-08-16 05:57 | evidence → | |
| 149.28.78.161 | reconnaissance | 27% | 32 | 1 | ssh:intrusion | 149.28.78.161.vultrusercontent.com | 2026-08-16 05:46 | evidence → | |
| 165.22.223.183 | reconnaissance | 27% | 32 | 1 | ssh:intrusion | — | 2026-08-16 06:32 | evidence → | |
| 151.80.25.153 | reconnaissance | 26% | 24 | 1 | ssh:intrusion | ns3017631.ip-151-80-25.eu | 2026-08-16 05:58 | evidence → | |
| 159.195.48.180 | reconnaissance | 25% | 16 | 1 | ssh:intrusion | v2202602340372436931.powersrv.de | 2026-08-16 05:34 | evidence → | |
| 5.189.135.243 | reconnaissance | 24% | 8 | 1 | ssh:intrusion | vmi3626564.contaboserver.net | 2026-08-16 03:02 | evidence → | |
| 164.68.105.207 | reconnaissance | 24% | 8 | 1 | ssh:intrusion | vmi422031.contaboserver.net | 2026-08-16 06:36 | evidence → | |
| 154.241.19.123 | opportunistic_bruter | 21% | 6 | 1 | ssh:bruteforce | — | 2026-08-18 06:28 | evidence → | |
| 183.62.159.92 | opportunistic_bruter | 21% | 6 | 1 | ssh:bruteforce | — | 2026-08-18 18:08 | evidence → | |
| 49.12.33.172 | ftp_probe | 21% | 19 | 1 | ftp:bruteforcessh:intrusion | static.172.33.12.49.clients.your-server.de | 2026-09-09 12:50 | evidence → | |
| 185.74.59.11 | credential_harvester | 20% | 286 | 1 | ssh:bruteforcessh:connection | — | 2026-08-16 19:21 | evidence → | |
| 8.133.188.11 | credential_probe | 12% | 10 | 1 | ssh:bruteforce | — | 2026-08-20 04:51 | evidence → | |
| 213.5.130.217 | credential_probe | 11% | 5 | 1 | ssh:bruteforce | dedi351262.bullionet | 2026-08-19 06:53 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds