← Back to feed
HASSH a4bb6308c6d3… — SSH-2.0-Go (74 IPs, 22 countries)
HASSH Ended highWhy this campaign was detected
74 IPs are running an identical SSH client (HASSH fingerprint a4bb6308c6d3…). Top network: netcup GmbH (AS197540). Geographic and ASN spread across distinct /16 subnets indicates a single operator running shared tooling on rented infrastructure — exactly the disguise that subnet/ASN clustering misses.
Primary ASN
AS197540 · netcup GmbH
Subnet
—
HASSH Fingerprint
Country
🇩🇪 DE
Cloud Provider
DO
Member Count
74 IPs
Average
Total Events
2741
Below average by volume
Started / Ended
2026-08-03 21:17 — ongoing
Attack Types
MITRE ATT&CK Techniques
Initial Access
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 67.215.227.54 | credential_harvester | 34% | 1x OSINT | 139 | 1 | ssh:bruteforce | — | 2026-08-24 00:52 | evidence → |
| 113.20.8.90 | credential_harvester | 34% | 1x OSINT | 123 | 1 | ssh:bruteforce | — | 2026-08-24 17:48 | evidence → |
| 61.73.27.69 | credential_harvester | 33% | 1x OSINT | 101 | 1 | ssh:bruteforce | — | 2026-08-24 07:36 | evidence → |
| 59.120.178.166 | credential_harvester | 33% | 1x OSINT | 94 | 1 | ssh:bruteforce | — | 2026-08-24 17:30 | evidence → |
| 64.226.70.41 | reconnaissance | 33% | 1x OSINT | 92 | 1 | ssh:bruteforce | — | 2026-08-12 08:10 | evidence → |
| 5.183.253.128 | reconnaissance | 33% | 1x OSINT | 91 | 1 | ssh:bruteforce | — | 2026-08-12 19:44 | evidence → |
| 66.154.115.247 | credential_harvester | 33% | 1x OSINT | 87 | 1 | ssh:bruteforce | — | 2026-08-24 06:30 | evidence → |
| 159.223.29.238 | credential_harvester | 33% | 1x OSINT | 81 | 1 | ssh:bruteforce | — | 2026-08-24 06:31 | evidence → |
| 152.53.199.246 | reconnaissance | 32% | 1x OSINT | 50 | 1 | ssh:bruteforce | — | 2026-08-08 18:20 | evidence → |
| 200.105.156.165 | credential_harvester | 29% | 168 | 1 | ssh:bruteforce | — | 2026-08-14 12:55 | evidence → | |
| 89.163.206.150 | reconnaissance | 29% | 130 | 1 | ssh:bruteforce | — | 2026-08-10 13:43 | evidence → | |
| 220.86.129.106 | opportunistic_bruter | 28% | 92 | 1 | ssh:bruteforce | — | 2026-08-24 06:11 | evidence → | |
| 116.118.9.79 | credential_harvester | 28% | 88 | 1 | ssh:bruteforce | — | 2026-08-12 18:41 | evidence → | |
| 43.134.23.41 | credential_harvester | 28% | 86 | 1 | ssh:bruteforce | — | 2026-08-24 07:37 | evidence → | |
| 117.72.42.21 | reconnaissance | 28% | 80 | 1 | ssh:bruteforce | — | 2026-08-08 18:11 | evidence → | |
| 156.239.238.244 | credential_harvester | 28% | 79 | 1 | ssh:bruteforce | — | 2026-08-24 06:01 | evidence → | |
| 185.232.68.89 | scanner | 28% | 62 | 1 | ssh:bruteforce | — | 2026-08-08 18:33 | evidence → | |
| 202.61.252.80 | reconnaissance | 28% | 58 | 1 | ssh:bruteforce | — | 2026-08-08 18:42 | evidence → | |
| 15.204.173.173 | reconnaissance | 28% | 56 | 1 | ssh:bruteforce | — | 2026-08-11 12:24 | evidence → | |
| 160.251.173.161 | reconnaissance | 28% | 56 | 1 | ssh:bruteforce | — | 2026-08-11 12:51 | evidence → | |
| 79.175.93.31 | reconnaissance | 27% | 54 | 1 | ssh:bruteforce | — | 2026-08-12 10:41 | evidence → | |
| 38.83.138.198 | reconnaissance | 27% | 51 | 1 | ssh:bruteforce | — | 2026-08-08 18:39 | evidence → | |
| 94.16.17.138 | scanner | 27% | 49 | 1 | ssh:bruteforce | — | 2026-08-08 18:02 | evidence → | |
| 89.58.12.105 | scanner | 27% | 47 | 1 | ssh:bruteforce | — | 2026-08-08 18:19 | evidence → | |
| 152.53.54.144 | reconnaissance | 27% | 45 | 1 | ssh:bruteforce | — | 2026-08-08 18:35 | evidence → | |
| 213.32.22.42 | reconnaissance | 27% | 43 | 1 | ssh:bruteforce | — | 2026-08-08 18:24 | evidence → | |
| 107.172.218.176 | reconnaissance | 27% | 43 | 1 | ssh:bruteforce | — | 2026-08-08 18:36 | evidence → | |
| 94.16.17.140 | scanner | 27% | 42 | 1 | ssh:bruteforce | — | 2026-08-08 17:51 | evidence → | |
| 37.120.191.93 | reconnaissance | 27% | 41 | 1 | ssh:bruteforce | — | 2026-08-08 18:38 | evidence → | |
| 129.226.201.189 | reconnaissance | 27% | 40 | 1 | ssh:bruteforce | — | 2026-08-08 18:13 | evidence → | |
| 179.237.82.223 | reconnaissance | 27% | 39 | 1 | ssh:bruteforce | — | 2026-08-08 18:36 | evidence → | |
| 46.149.66.61 | reconnaissance | 27% | 39 | 1 | ssh:bruteforce | — | 2026-08-11 18:46 | evidence → | |
| 178.104.90.251 | reconnaissance | 27% | 37 | 1 | ssh:bruteforce | — | 2026-08-12 09:19 | evidence → | |
| 178.105.235.156 | reconnaissance | 27% | 35 | 1 | ssh:bruteforce | — | 2026-08-08 18:33 | evidence → | |
| 107.173.214.153 | reconnaissance | 27% | 34 | 1 | ssh:bruteforce | — | 2026-08-11 19:16 | evidence → | |
| 185.148.129.112 | reconnaissance | 27% | 31 | 1 | ssh:bruteforce | — | 2026-08-08 18:40 | evidence → | |
| 159.195.38.88 | reconnaissance | 26% | 28 | 1 | ssh:bruteforce | — | 2026-08-08 18:31 | evidence → | |
| 116.123.150.72 | reconnaissance | 26% | 26 | 1 | ssh:bruteforce | — | 2026-08-11 12:28 | evidence → | |
| 24.233.0.36 | reconnaissance | 26% | DROP | 25 | 1 | ssh:bruteforce | — | 2026-08-08 18:04 | evidence → |
| 221.141.48.177 | reconnaissance | 26% | 24 | 1 | ssh:bruteforce | — | 2026-08-08 18:29 | evidence → | |
| 23.94.29.214 | reconnaissance | 26% | 21 | 1 | ssh:bruteforce | — | 2026-08-08 18:47 | evidence → | |
| 113.74.252.159 | reconnaissance | 26% | 21 | 1 | ssh:bruteforce | — | 2026-08-08 19:48 | evidence → | |
| 138.226.237.165 | reconnaissance | 26% | DROP | 21 | 1 | ssh:bruteforce | — | 2026-08-08 18:32 | evidence → |
| 5.39.73.45 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-08 18:39 | evidence → | |
| 61.105.6.100 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-08 18:11 | evidence → | |
| 23.170.48.33 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-08 18:32 | evidence → | |
| 176.202.87.194 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-08 19:28 | evidence → | |
| 43.132.228.37 | reconnaissance | 25% | 16 | 1 | ssh:bruteforce | — | 2026-08-08 18:11 | evidence → | |
| 62.3.42.80 | reconnaissance | 25% | 15 | 1 | ssh:bruteforce | — | 2026-08-08 18:41 | evidence → | |
| 82.152.164.175 | reconnaissance | 25% | 15 | 1 | ssh:bruteforce | — | 2026-08-08 17:56 | evidence → | |
| 81.10.39.215 | reconnaissance | 24% | 8 | 1 | ssh:bruteforce | — | 2026-08-08 17:49 | evidence → | |
| 189.153.32.21 | reconnaissance | 24% | 8 | 1 | ssh:bruteforce | — | 2026-08-08 17:58 | evidence → | |
| 124.134.46.183 | reconnaissance | 24% | 8 | 1 | ssh:bruteforce | — | 2026-08-08 17:59 | evidence → | |
| 24.15.74.210 | reconnaissance | 24% | 8 | 1 | ssh:bruteforce | — | 2026-08-08 18:33 | evidence → | |
| 23.147.56.51 | credential_probe | 20% | 1x OSINT | 56 | 1 | ssh:bruteforce | — | 2026-08-12 09:03 | evidence → |
| 23.254.242.32 | credential_probe | 18% | 1x OSINT | 22 | 1 | ssh:bruteforce | — | 2026-08-08 17:48 | evidence → |
| 77.90.42.3 | credential_probe | 15% | 52 | 1 | ssh:bruteforce | — | 2026-08-08 18:47 | evidence → | |
| 152.53.52.136 | credential_probe | 15% | 45 | 1 | ssh:bruteforce | — | 2026-08-08 18:38 | evidence → | |
| 94.16.17.136 | credential_probe | 15% | 44 | 1 | ssh:bruteforce | — | 2026-08-08 18:19 | evidence → | |
| 78.47.87.101 | credential_probe | 14% | 37 | 1 | ssh:bruteforce | — | 2026-08-08 18:22 | evidence → | |
| 89.167.114.179 | credential_probe | 14% | 35 | 1 | ssh:bruteforce | — | 2026-08-08 18:29 | evidence → | |
| 15.204.118.38 | credential_probe | 14% | 32 | 1 | ssh:bruteforce | — | 2026-08-08 18:34 | evidence → | |
| 85.198.9.131 | credential_probe | 14% | 28 | 1 | ssh:bruteforce | — | 2026-08-11 23:51 | evidence → | |
| 43.163.104.248 | credential_probe | 14% | 27 | 1 | ssh:bruteforce | — | 2026-08-08 18:23 | evidence → | |
| 45.136.31.153 | credential_probe | 13% | 22 | 1 | ssh:bruteforce | — | 2026-08-08 18:35 | evidence → | |
| 37.32.11.205 | credential_probe | 13% | 22 | 1 | ssh:bruteforce | — | 2026-08-08 18:15 | evidence → | |
| 165.227.229.146 | credential_probe | 13% | 18 | 1 | ssh:bruteforce | — | 2026-08-08 18:45 | evidence → | |
| 202.92.128.216 | credential_probe | 13% | 18 | 1 | ssh:bruteforce | — | 2026-08-08 18:35 | evidence → | |
| 121.134.185.166 | credential_probe | 13% | 18 | 1 | ssh:bruteforce | — | 2026-08-08 18:40 | evidence → | |
| 185.82.86.94 | credential_probe | 13% | 18 | 1 | ssh:bruteforce | — | 2026-08-08 18:43 | evidence → | |
| 173.249.59.206 | credential_probe | 13% | 17 | 1 | ssh:bruteforce | — | 2026-08-11 23:40 | evidence → | |
| 75.119.143.144 | credential_probe | 12% | 10 | 1 | ssh:bruteforce | — | 2026-08-08 18:19 | evidence → | |
| 159.69.107.97 | credential_probe | 12% | 10 | 1 | ssh:bruteforce | — | 2026-08-08 18:42 | evidence → | |
| 107.148.229.185 | credential_probe | 11% | 5 | 1 | ssh:bruteforce | — | 2026-08-08 18:27 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds