{ "generated_at": "2026-10-26T17:15:19+00:00", "feed_version": "2.0", "source": "LSN Honeypot Intelligence Platform", "description": "Comprehensive threat intelligence from production SSH honeypot with multi-source OSINT enrichment, entity graph analysis, and behavioral clustering.", "coverage": { "entity_graph_edges": 740787, "deep_enriched_ips": 31079, "pipeline_sources": [ { "source": "otx", "enriched": 18946, "total_attempted": 18946 }, { "source": "shodan", "enriched": 8845, "total_attempted": 8846 }, { "source": "dshield", "enriched": 8836, "total_attempted": 8836 }, { "source": "abuseipdb", "enriched": 4739, "total_attempted": 4739 }, { "source": "ipinfo", "enriched": 4203, "total_attempted": 4203 }, { "source": "pulsedive", "enriched": 2298, "total_attempted": 2298 }, { "source": "virustotal", "enriched": 2026, "total_attempted": 2026 }, { "source": "active_recon", "enriched": 1334, "total_attempted": 1334 }, { "source": "censys", "enriched": 494, "total_attempted": 1274 }, { "source": "greynoise", "enriched": 308, "total_attempted": 308 }, { "source": "threatfox", "enriched": 95, "total_attempted": 18193 }, { "source": "urlhaus", "enriched": 81, "total_attempted": 17945 } ] }, "actor_clusters": [ { "cluster_id": "hassh_4ed0d5b0dc3b", "hassh": "4ed0d5b0dc3be39c7f96ba3a3cc77895", "tool": null, "ip_count": 36, "avg_threat_score": 83.6, "countries": { "NL": 10, "SI": 11, "DE": 12, "LU": 3 }, "top_asns": { "AS197769": 18, "AS197170": 12, "AS205759": 3, "AS198584": 2, "AS401626": 1 }, "organizations": [ "TechTies Inc.", "Netiface America, Inc.", "Idayat Raji", "Ghosty Networks LLC", "Felcloud", "VPS Dedicated LLC", "techties-mnt", "Netiface LLC" ], "shared_credentials": [ { "username": "AdminGPON", "password": "ALC#FGU", "ip_count": 13 }, { "username": "support", "password": "support", "ip_count": 12 }, { "username": "admin", "password": "admin", "ip_count": 11 }, { "username": "root", "password": "admin", "ip_count": 10 }, { "username": "root", "password": "root", "ip_count": 10 }, { "username": "user3", "password": "1234", "ip_count": 9 }, { "username": "router", "password": "admin!@#", "ip_count": 9 }, { "username": "root", "password": "adminpass", "ip_count": 9 }, { "username": "root", "password": "2wsx#EDC", "ip_count": 8 }, { "username": "root", "password": "end123", "ip_count": 8 }, { "username": "admin", "password": "12345678", "ip_count": 8 }, { "username": "admin", "password": "password", "ip_count": 8 }, { "username": "config", "password": "config", "ip_count": 8 }, { "username": "debian", "password": "temppwd", "ip_count": 8 }, { "username": "ubnt", "password": "ubnt", "ip_count": 8 }, { "username": "telecomadmin", "password": "admintelecom", "ip_count": 8 }, { "username": "test", "password": "test", "ip_count": 7 }, { "username": "admin", "password": "1234567890", "ip_count": 7 }, { "username": "root", "password": "Aa123456...", "ip_count": 7 }, { "username": "root", "password": "fa", "ip_count": 7 }, { "username": "root", "password": "qweasdzxc2002", "ip_count": 7 }, { "username": "pi", "password": "bananapi", "ip_count": 6 }, { "username": "user", "password": "user", "ip_count": 6 }, { "username": "ftp", "password": "ftp", "ip_count": 6 }, { "username": "admin", "password": "admin@123", "ip_count": 6 }, { "username": "operator", "password": "operator", "ip_count": 5 }, { "username": "ubnt", "password": "ubnt1", "ip_count": 5 }, { "username": "sshd", "password": "", "ip_count": 5 }, { "username": "orangepi", "password": "orangepi", "ip_count": 4 }, { "username": "pi", "password": "pi", "ip_count": 4 }, { "username": "root", "password": "", "ip_count": 4 }, { "username": "root", "password": "abcd1234", "ip_count": 4 }, { "username": "admin", "password": "p@ssw0rd", "ip_count": 4 }, { "username": "root", "password": "synergy", "ip_count": 4 }, { "username": "squid", "password": "squid", "ip_count": 4 }, { "username": "admin", "password": "123456789", "ip_count": 4 }, { "username": "admin", "password": "1234", "ip_count": 4 }, { "username": "user", "password": "1234", "ip_count": 4 }, { "username": "admin", "password": "", "ip_count": 3 }, { "username": "ftpuser", "password": "ftppassword", "ip_count": 3 }, { "username": "admin", "password": "admin123", "ip_count": 3 }, { "username": "localhost", "password": "mFwOHAYibwOdDDcVJXeB", "ip_count": 3 }, { "username": "root", "password": "NSSpassword1", "ip_count": 3 }, { "username": "default", "password": "", "ip_count": 3 }, { "username": "user", "password": "password", "ip_count": 2 }, { "username": "root", "password": "22&%DJO*8Ph@1ZlfyaT^Y8#Iw&Od0B&W123", "ip_count": 2 }, { "username": "montes", "password": "montes", "ip_count": 2 }, { "username": "admin", "password": "admin01", "ip_count": 2 }, { "username": "ftp", "password": "", "ip_count": 2 }, { "username": "root", "password": "P@ssw0rd", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "102.220.160.172": [ "otx", "shodan" ], "130.12.182.107": [ "otx", "shodan" ], "130.12.182.225": [ "virustotal", "otx", "threatfox" ], "130.12.182.230": [ "otx" ], "130.12.182.224": [ "otx", "threatfox" ], "130.12.182.227": [ "otx" ], "130.12.182.223": [ "otx" ], "130.12.182.231": [ "otx" ], "102.220.160.29": [ "virustotal", "dshield" ], "64.89.162.38": [ "pulsedive", "otx", "dshield" ], "102.220.160.26": [ "pulsedive", "virustotal", "otx", "dshield", "censys" ], "102.220.160.67": [ "pulsedive", "otx", "dshield" ], "31.57.216.45": [ "pulsedive", "otx", "threatfox", "dshield" ], "64.89.161.91": [ "pulsedive", "virustotal", "otx", "dshield" ], "45.153.34.158": [ "pulsedive", "virustotal", "urlhaus", "dshield", "censys" ], "102.220.160.38": [ "pulsedive", "virustotal", "dshield" ], "31.57.184.247": [ "pulsedive", "otx", "dshield" ], "45.156.87.161": [ "dshield" ], "94.26.106.199": [ "pulsedive", "dshield" ], "102.220.160.41": [ "pulsedive", "otx" ] }, "sample_ips": [ { "ip": "45.156.87.50", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 96.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.47", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 96.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.39", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 96.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.225", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 94.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.38", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 94.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.89.161.91", "country": "LU", "asn": 205759, "org": "GHOSTYNETWORKS - Ghosty Networks LLC, US", "threat_score": 94.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.153.34.158", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.242.3.121", "country": "DE", "asn": 401626, "org": "NETIFACE-TORONTO - Netiface America, Inc., US", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.67", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 92.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.107", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 92.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.89.161.93", "country": "LU", "asn": 205759, "org": "GHOSTYNETWORKS - Ghosty Networks LLC, US", "threat_score": 92.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.26.106.253", "country": "DE", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 92.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.26.106.103", "country": "DE", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.42", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.156.87.162", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.26.106.199", "country": "DE", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 90.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.41", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 89.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.153.34.47", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 88.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.89.162.38", "country": "NL", "asn": 198584, "org": "PIO-Hosting - PIO-Hosting GmbH, DE", "threat_score": 88.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.156.87.178", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 87.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.89.162.146", "country": "NL", "asn": 198584, "org": "PIO-Hosting - PIO-Hosting GmbH, DE", "threat_score": 87.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.89.161.90", "country": "LU", "asn": 205759, "org": "GHOSTYNETWORKS - Ghosty Networks LLC, US", "threat_score": 87.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.224", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 86.2, "abuse_score": 73, "is_tor": false, "greynoise": null }, { "ip": "31.57.216.45", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 85.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.231", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 82.6, "abuse_score": 79, "is_tor": false, "greynoise": null }, { "ip": "45.156.87.163", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 81.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.223", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 79.4, "abuse_score": 71, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.227", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 77.2, "abuse_score": 63, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.26", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 76.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.156.87.192", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 69.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "130.12.182.230", "country": "DE", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 67.6, "abuse_score": 44, "is_tor": false, "greynoise": null }, { "ip": "31.57.184.247", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 66.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.26.106.33", "country": "DE", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 64.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.29", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 57.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "102.220.160.172", "country": "SI", "asn": 197769, "org": "VPSDEDICATED-AS - VPS Dedicated LLC, US", "threat_score": 57.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.156.87.161", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 49.0, "abuse_score": 100, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_30d88ae4c43d", "hassh": "30d88ae4c43d9ac31e09479b4204a646", "tool": null, "ip_count": 34, "avg_threat_score": 79.0, "countries": { "LT": 3, "NL": 25, "DE": 5, "GB": 1 }, "top_asns": { "AS199457": 17, "AS213790": 12, "AS208137": 5 }, "organizations": [ "Limited Network LTD", "Secure Internet LLC (UK)", "Feo Prest SRL", "IRT-INTERNETSRV-HK" ], "shared_credentials": [ { "username": "root", "password": "", "ip_count": 30 }, { "username": "admin", "password": "", "ip_count": 29 }, { "username": "root", "password": "googlegoogle1986.", "ip_count": 18 }, { "username": "admin", "password": "googlegoogle1986.", "ip_count": 18 }, { "username": "debian", "password": "googlegoogle1986.", "ip_count": 17 }, { "username": "root", "password": "Multumesc123", "ip_count": 15 }, { "username": "root", "password": "Google1986.", "ip_count": 14 }, { "username": "lsnadmin", "password": "googlegoogle1986.", "ip_count": 14 }, { "username": "admin", "password": "Google1986.", "ip_count": 13 }, { "username": "admin", "password": "Multumesc123", "ip_count": 13 }, { "username": "admin", "password": "admin", "ip_count": 11 }, { "username": "ubuntu", "password": "Google1986.", "ip_count": 11 }, { "username": "root", "password": "LSN1q2w3e4r", "ip_count": 10 }, { "username": "admin", "password": "LSN1q2w3e4r", "ip_count": 9 }, { "username": "debian", "password": "LSN1q2w3e4r", "ip_count": 9 }, { "username": "lsn-david", "password": "LSN1q2w3e4r", "ip_count": 9 }, { "username": "lsn-cristi", "password": "LSN1q2w3e4r", "ip_count": 8 }, { "username": "[REDACTED]", "password": "[REDACTED]", "ip_count": 8 }, { "username": "lsndavid", "password": "googlegoogle1986.", "ip_count": 8 }, { "username": "root", "password": "admin", "ip_count": 7 }, { "username": "ubuntu", "password": "Multumesc123", "ip_count": 6 }, { "username": "root", "password": "webmaster", "ip_count": 5 }, { "username": "[REDACTED]", "password": "[REDACTED]", "ip_count": 4 }, { "username": "mail.shuffle-on.com", "password": "webmaster", "ip_count": 4 }, { "username": "admin", "password": "webmaster", "ip_count": 4 }, { "username": "root", "password": "12165035:4717", "ip_count": 4 }, { "username": "[REDACTED]", "password": "[REDACTED]", "ip_count": 4 }, { "username": "lsnadmin", "password": "Google1986.", "ip_count": 4 }, { "username": "root", "password": "*CraLqNNY3Z&goSc", "ip_count": 3 }, { "username": "admin", "password": "LSN1q2w3e4r.", "ip_count": 3 }, { "username": "admin", "password": "google", "ip_count": 3 }, { "username": "debian", "password": "Multumesc123", "ip_count": 3 }, { "username": "lsn-cristi", "password": "Google1986.", "ip_count": 3 }, { "username": "mail.shuffle-on.com", "password": "admin", "ip_count": 3 }, { "username": "root", "password": "*cralqnny3z&gosc", "ip_count": 3 }, { "username": "root", "password": "LSN1q2w3e4r.", "ip_count": 3 }, { "username": "root", "password": "google", "ip_count": 3 }, { "username": "ubuntu", "password": "google", "ip_count": 3 }, { "username": "[REDACTED]", "password": "[REDACTED]", "ip_count": 3 }, { "username": "lsnadmin", "password": "Googlegoogle1986.", "ip_count": 2 }, { "username": "root", "password": "Googlegoogle1986.", "ip_count": 2 }, { "username": "[REDACTED]", "password": "[REDACTED]", "ip_count": 2 }, { "username": "ubuntu", "password": "admin", "ip_count": 2 }, { "username": "lsn-david", "password": "Multumesc123", "ip_count": 2 }, { "username": "debian", "password": "*cralqnny3z&gosc", "ip_count": 2 }, { "username": "root", "password": "bim5ec78", "ip_count": 2 }, { "username": "ubuntu", "password": "webmaster", "ip_count": 2 }, { "username": "admin@mail.shuffle-on.com", "password": "Google1986.", "ip_count": 2 }, { "username": "admin", "password": "Googlegoogle1986.", "ip_count": 2 }, { "username": "tecnico", "password": "*cralqnny3z&gosc", "ip_count": 2 } ], "shared_commands": [ { "cmd": "uname -m; uname -s", "ips": 3 }, { "cmd": "id -u 2>/dev/null; free -m 2>/dev/null | awk \"NR==2{print \\$2}\"", "ips": 2 } ], "deep_enrichment_coverage": { "45.115.26.30": [ "virustotal", "otx" ], "45.115.26.40": [ "virustotal", "otx" ], "185.93.89.135": [ "active_recon" ], "45.115.26.21": [ "pulsedive", "otx", "dshield" ], "45.115.26.35": [ "pulsedive", "otx" ], "45.115.26.36": [ "pulsedive", "virustotal", "otx" ], "45.115.26.38": [ "pulsedive", "virustotal", "otx" ], "45.115.26.37": [ "pulsedive", "otx" ], "45.115.26.19": [ "otx" ], "45.115.26.43": [ "pulsedive", "otx" ], "45.115.26.27": [ "otx" ], "77.90.185.128": [ "otx", "shodan" ], "45.115.26.20": [ "otx" ], "45.115.26.44": [ "otx" ], "45.115.26.32": [ "otx" ], "45.115.26.22": [ "otx", "dshield" ], "45.115.26.155": [ "virustotal", "otx", "dshield", "censys" ], "45.115.26.41": [ "otx", "dshield" ], "45.115.26.42": [ "otx", "dshield" ], "213.177.179.14": [ "virustotal", "otx", "dshield", "censys", "shodan" ], "77.90.185.41": [ "otx", "shodan" ], "213.209.159.48": [ "otx" ], "172.94.9.73": [ "otx", "shodan" ], "77.90.185.121": [ "otx", "threatfox", "shodan" ] }, "sample_ips": [ { "ip": "77.90.185.54", "country": "LT", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "77.90.185.121", "country": "LT", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "172.94.9.74", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "213.177.179.14", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "77.90.185.41", "country": "GB", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.40", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.155", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.30", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "192.253.248.21", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 90.6, "abuse_score": 84, "is_tor": false, "greynoise": null }, { "ip": "213.209.159.48", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 89.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "172.94.9.73", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 89.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.93.89.116", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 89.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.93.89.135", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 88.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "213.209.159.41", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 88.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.21", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 87.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.19", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 86.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.93.89.19", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 86.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.43", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 83.0, "abuse_score": 90, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.27", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 80.6, "abuse_score": 84, "is_tor": false, "greynoise": null }, { "ip": "213.209.159.42", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 79.0, "abuse_score": 80, "is_tor": false, "greynoise": null }, { "ip": "172.94.9.202", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 78.4, "abuse_score": 81, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.38", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 78.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.44", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 77.8, "abuse_score": 77, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.36", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 74.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.35", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 72.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "172.94.9.222", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 71.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.22", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 70.2, "abuse_score": 58, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.37", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 69.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.41", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 58.6, "abuse_score": 29, "is_tor": false, "greynoise": null }, { "ip": "213.209.159.43", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 53.2, "abuse_score": 18, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.42", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 50.8, "abuse_score": 12, "is_tor": false, "greynoise": null }, { "ip": "77.90.185.128", "country": "LT", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 48.0, "abuse_score": 45, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.32", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 47.2, "abuse_score": 58, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.20", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 43.8, "abuse_score": 77, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_d00d43d15d59", "hassh": "d00d43d15d59705b090cf74488cc2218", "tool": null, "ip_count": 31, "avg_threat_score": 55.7, "countries": { "NL": 21, "SE": 5, "FR": 3, "US": 1, "PL": 1 }, "top_asns": { "AS215125": 21, "AS214503": 4, "AS8473": 1, "AS20766": 1, "AS36149": 1, "AS29075": 1, "AS51290": 1, "AS213873": 1 }, "organizations": [ "HAWAIIAN TELCOM", "MNT-QUXLABS", "Association Globenet", "BAHNHOF-NCC", "MOJI SAS", "RIPE-NCC-END-MNT", "SN-LIR-MNT", "AS1101-MNT", "Association Nos Oignons" ], "shared_credentials": [ { "username": "root", "password": "", "ip_count": 31 }, { "username": "root", "password": "root", "ip_count": 30 }, { "username": "admin", "password": "admin", "ip_count": 5 }, { "username": "admin", "password": "", "ip_count": 2 }, { "username": "root", "password": "admin", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "45.84.107.17": [ "active_recon" ], "203.55.81.1": [ "otx", "dshield" ], "192.42.116.68": [ "otx", "shodan" ], "192.42.116.12": [ "otx" ], "192.42.116.50": [ "otx", "shodan" ], "192.42.116.53": [ "otx", "shodan" ], "192.42.116.106": [ "shodan" ], "192.42.116.99": [ "otx", "shodan" ], "192.42.116.118": [ "greynoise", "otx", "shodan" ], "192.42.116.143": [ "greynoise", "otx", "shodan" ], "91.206.26.26": [ "dshield" ], "178.20.55.182": [ "dshield" ], "80.67.172.162": [ "otx", "dshield" ], "45.84.107.174": [ "otx", "dshield" ], "45.84.107.128": [ "otx", "dshield" ], "45.84.107.74": [ "shodan" ], "141.239.158.222": [ "shodan" ], "192.42.116.144": [ "otx", "dshield", "shodan" ], "192.42.116.49": [ "otx", "dshield", "shodan" ], "192.42.116.93": [ "abuseipdb" ], "192.42.116.52": [ "abuseipdb", "otx" ], "192.42.116.112": [ "abuseipdb", "otx" ], "192.42.116.16": [ "abuseipdb", "otx", "shodan" ], "192.42.116.42": [ "abuseipdb", "otx", "shodan" ], "192.42.116.60": [ "abuseipdb", "otx" ], "192.42.116.98": [ "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "192.42.116.43", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 80.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.60", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 75.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.42", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 73.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.98", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 73.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "109.228.160.190", "country": "SE", "asn": 8473, "org": "BAHNHOF, SE", "threat_score": 72.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.67", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 71.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.14", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 68.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.112", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 67.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.144", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 67.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.49", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 66.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.118", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 66.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.12", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 61.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.99", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 60.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.50", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 59.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.143", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 59.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.53", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 59.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "80.67.172.162", "country": "FR", "asn": 20766, "org": "GITOYEN-MAIN-AS - Association _Gitoyen_, FR", "threat_score": 59.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "141.239.158.222", "country": "US", "asn": 36149, "org": "HAWAIIAN-TELCOM - Hawaiian Telcom Services Company, Inc., US", "threat_score": 58.0, "abuse_score": 85, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.106", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 55.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "178.20.55.182", "country": "FR", "asn": 29075, "org": "IELO - IELO-LIAZO SERVICES SAS, FR", "threat_score": 54.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "91.206.26.26", "country": "PL", "asn": 51290, "org": "HOSTEAM-AS - BARTOSZ WASZAK trading as HOSTEAM S.C. TOMASZ GROSZEWSKI BARTOSZ WASZAK LUKASZ GROSZEWSKI, PL", "threat_score": 54.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "45.84.107.174", "country": "SE", "asn": 214503, "org": "QUXLABS - QuxLabs AB, SE", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.84.107.128", "country": "SE", "asn": 214503, "org": "QUXLABS - QuxLabs AB, SE", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.84.107.74", "country": "SE", "asn": 214503, "org": "QUXLABS - QuxLabs AB, SE", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.84.107.17", "country": "SE", "asn": 214503, "org": "QUXLABS - QuxLabs AB, SE", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "192.42.116.52", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 36.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.93", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 35.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.117", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 34.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.16", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 31.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.68", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 20.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "203.55.81.1", "country": "FR", "asn": 213873, "org": "OUIDO-Hosting - MOJI SAS, FR", "threat_score": 19.0, "abuse_score": null, "is_tor": true, "greynoise": null } ] }, { "cluster_id": "hassh_1ab01ea55927", "hassh": "1ab01ea559275860be73fe29c5d077bd", "tool": { "name": "Ganymed_null", "classification": "unknown" }, "ip_count": 27, "avg_threat_score": 32.3, "countries": { "RO": 1, "US": 7, "BR": 3, "BD": 1, "SE": 1, "CL": 1, "EE": 1, "DK": 1, "IT": 1, "FR": 3, "ID": 1, "KR": 1, "NL": 1, "VN": 1, "FI": 1, "PY": 1, "DE": 1 }, "top_asns": { "AS14061": 4, "AS46606": 2, "AS31898": 2, "AS42201": 2, "AS51167": 2, "AS47890": 1, "AS38614": 1, "AS40021": 1, "AS57858": 1, "AS18747": 1, "AS202759": 1, "AS1299": 1, "AS16276": 1, "AS58487": 1, "AS38700": 1, "AS49981": 1, "AS151908": 1, "AS271011": 1, "AS24940": 1, "AS264631": 1 }, "organizations": [ "DigitalOcean, LLC", "Unified Layer", "Cogent Communications, LLC", "RED PARAGUAYA DE TELECOMUNICACIONES SA", "TECHOFF SRV LIMITED", "SpedyNet Telecom", "PVDataNet NOC", "Oso Grande IP Services, LLC", "Nordic Internet Service AB", "IRT-KRNIC-KR", "IRT-VNNIC-AP", "Rumahweb", "Hetzner Online GmbH", "Contabo GmbH", "PVDataNet AB", "IRT-IDS-BANGLADESH-BD", "IFX Networks Chile S.A", "BELBACHIR Lamine", "Abuse-C Role" ], "shared_credentials": [ { "username": "root", "password": "Google1986.", "ip_count": 21 }, { "username": "root", "password": "Google1986", "ip_count": 6 } ], "shared_commands": [], "deep_enrichment_coverage": { "135.181.60.58": [ "otx" ], "196.196.23.45": [ "otx", "shodan" ], "45.130.85.2": [ "otx", "dshield", "shodan" ], "38.242.230.113": [ "otx", "shodan" ], "217.182.190.42": [ "otx", "shodan" ], "138.68.3.204": [ "pulsedive", "otx", "dshield" ], "146.190.230.216": [ "otx", "dshield", "shodan" ], "62.115.255.163": [ "otx", "shodan" ], "185.155.97.139": [ "shodan" ], "200.73.18.40": [ "otx", "shodan" ], "117.103.80.92": [ "otx", "dshield", "shodan" ], "157.20.60.74": [ "otx", "shodan" ], "129.121.35.21": [ "virustotal", "otx", "shodan" ], "49.247.25.151": [ "otx", "shodan" ], "162.215.14.162": [ "otx", "shodan" ], "103.247.8.25": [ "otx", "shodan" ], "2.57.122.98": [ "dshield" ], "129.121.35.232": [ "otx", "dshield", "shodan" ], "190.8.175.6": [ "dshield", "shodan" ], "185.180.223.26": [ "ipinfo", "abuseipdb", "otx", "shodan" ], "162.214.205.79": [ "ipinfo", "abuseipdb", "otx", "shodan" ], "212.56.41.95": [ "pulsedive" ] }, "sample_ips": [ { "ip": "2.57.122.98", "country": "RO", "asn": 47890, "org": "UNMANAGED-DEDICATED-SERVERS - UNMANAGED LTD, GB", "threat_score": 73.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "162.214.205.79", "country": "US", "asn": 46606, "org": "UNIFIEDLAYER-AS-1 - Unified Layer, US", "threat_score": 68.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "129.121.35.21", "country": "BR", "asn": 31898, "org": "ORACLE-BMC-31898 - Oracle Corporation, US", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "162.215.14.162", "country": "US", "asn": 46606, "org": "UNIFIEDLAYER-AS-1 - Unified Layer, US", "threat_score": 53.2, "abuse_score": 78, "is_tor": false, "greynoise": null }, { "ip": "117.103.80.92", "country": "BD", "asn": 38614, "org": "IDS-BD - IDS Bangladesh. IP Transit provider. Dhaka, Bangladesh, BD", "threat_score": 48.4, "abuse_score": 86, "is_tor": false, "greynoise": null }, { "ip": "138.68.3.204", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "212.56.41.95", "country": "US", "asn": 40021, "org": "CONTABO-40021 - Contabo Inc., US", "threat_score": 47.4, "abuse_score": 76, "is_tor": false, "greynoise": null }, { "ip": "196.196.23.45", "country": "SE", "asn": 57858, "org": "AS57858 - Angelnet Limited, SC", "threat_score": 44.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "200.73.18.40", "country": "CL", "asn": 18747, "org": "IFX18747 - IFX Corporation, US", "threat_score": 44.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.155.97.139", "country": "EE", "asn": 202759, "org": "FairyHosting - RJ Network OU, EE", "threat_score": 37.2, "abuse_score": 83, "is_tor": false, "greynoise": null }, { "ip": "62.115.255.163", "country": "DK", "asn": 1299, "org": "TWELVE99 - Arelion Sweden AB, SE", "threat_score": 35.6, "abuse_score": 74, "is_tor": false, "greynoise": null }, { "ip": "45.130.85.2", "country": "IT", "asn": 42201, "org": "PVDataNet - PVDataNet AB, SE", "threat_score": 34.4, "abuse_score": 76, "is_tor": false, "greynoise": null }, { "ip": "217.182.190.42", "country": "FR", "asn": 16276, "org": "OVH - OVH SAS, FR", "threat_score": 34.0, "abuse_score": 75, "is_tor": false, "greynoise": null }, { "ip": "91.240.64.5", "country": "FR", "asn": 42201, "org": "PVDataNet - PVDataNet AB, SE", "threat_score": 30.8, "abuse_score": 67, "is_tor": false, "greynoise": null }, { "ip": "38.242.230.113", "country": "FR", "asn": 51167, "org": "CONTABO - Contabo GmbH, DE", "threat_score": 30.8, "abuse_score": 67, "is_tor": false, "greynoise": null }, { "ip": "103.247.8.25", "country": "ID", "asn": 58487, "org": "CRI-AS-AP - CV. Rumahweb Indonesia, ID", "threat_score": 29.2, "abuse_score": 38, "is_tor": false, "greynoise": null }, { "ip": "129.121.35.232", "country": "BR", "asn": 31898, "org": "ORACLE-BMC-31898 - Oracle Corporation, US", "threat_score": 22.0, "abuse_score": 35, "is_tor": false, "greynoise": null }, { "ip": "49.247.25.151", "country": "KR", "asn": 38700, "org": "SMILESERV-AS-KR-KR - SMILESERV, KR", "threat_score": 21.2, "abuse_score": 43, "is_tor": false, "greynoise": null }, { "ip": "185.180.223.26", "country": "NL", "asn": 49981, "org": "WorldStream - WorldStream B.V., NL", "threat_score": 21.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "157.20.60.74", "country": "VN", "asn": 151908, "org": "MAYCHUVIET-VN - MAY CHU VIET SOLUTIONS CORPORATION, VN", "threat_score": 20.0, "abuse_score": 15, "is_tor": false, "greynoise": null }, { "ip": "190.8.175.6", "country": "BR", "asn": 271011, "org": "AS271011 - SpedyNet Telecom, BR", "threat_score": 18.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "146.190.230.216", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 14.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "135.181.60.58", "country": "FI", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 12.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "143.202.208.242", "country": "PY", "asn": 264631, "org": "AS264631 - RED PARAGUAYA DE TELECOMUNICACIONES SA, PY", "threat_score": 11.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "143.244.136.0", "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "threat_score": 8.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "64.227.138.5", "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "threat_score": 4.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "161.97.175.65", "country": "DE", "asn": 51167, "org": "CONTABO - Contabo GmbH, DE", "threat_score": 0.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_1cc79c7da9b5", "hassh": "1cc79c7da9b5d5eead2c60983332a556", "tool": { "name": "openssh_modern", "classification": "modern" }, "ip_count": 26, "avg_threat_score": 47.0, "countries": { "NL": 23, "DE": 1, "FR": 1, "CA": 1 }, "top_asns": { "AS215125": 23, "AS60729": 1, "AS213873": 1, "AS12093": 1 }, "organizations": [ "ZWIEBELFREUNDE", "Jeff Voskamp (computer consultant)", "SN-LIR-MNT", "lir-fr-julesd-1-MNT", "AS1101-MNT" ], "shared_credentials": [ { "username": "root", "password": "", "ip_count": 26 }, { "username": "root", "password": "root", "ip_count": 26 }, { "username": "admin", "password": "admin", "ip_count": 4 } ], "shared_commands": [], "deep_enrichment_coverage": { "198.96.155.3": [ "otx", "shodan" ], "192.42.116.97": [ "otx", "shodan" ], "192.42.116.46": [ "active_recon" ], "192.42.116.144": [ "otx", "dshield", "shodan" ], "192.42.116.51": [ "otx", "dshield" ], "192.42.116.95": [ "otx", "dshield", "shodan" ], "192.42.116.49": [ "otx", "dshield", "shodan" ], "192.42.116.18": [ "ipinfo", "dshield", "shodan" ], "203.55.81.2": [ "ipinfo", "abuseipdb", "otx" ], "192.42.116.93": [ "abuseipdb" ], "192.42.116.48": [ "abuseipdb", "otx" ], "192.42.116.52": [ "abuseipdb", "otx" ], "192.42.116.101": [ "abuseipdb", "otx" ], "192.42.116.61": [ "abuseipdb", "otx" ], "192.42.116.92": [ "abuseipdb", "otx", "shodan" ], "192.42.116.16": [ "abuseipdb", "otx", "shodan" ], "192.42.116.107": [ "abuseipdb", "otx", "shodan" ], "192.42.116.13": [ "abuseipdb", "otx" ], "192.42.116.43": [ "abuseipdb", "otx", "shodan" ], "192.42.116.117": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "dshield" ] }, "sample_ips": [ { "ip": "192.42.116.43", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 80.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.111", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 79.0, "abuse_score": 100, "is_tor": true, "greynoise": "malicious" }, { "ip": "192.42.116.144", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 67.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.49", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 66.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.59", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 65.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "185.220.101.167", "country": "DE", "asn": 60729, "org": "TORSERVERS-NET - Stiftung Erneuerbare Freiheit, DE", "threat_score": 64.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "192.42.116.100", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 63.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.96", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 63.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.51", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 60.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.97", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 60.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.58", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 59.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.95", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 59.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.18", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 55.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.46", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 55.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.52", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 36.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.93", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 35.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.117", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 34.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.16", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 31.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.13", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 29.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.92", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 27.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.101", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 24.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "203.55.81.2", "country": "FR", "asn": 213873, "org": "OUIDO-Hosting - MOJI SAS, FR", "threat_score": 24.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.48", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 23.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.61", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 23.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.107", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 23.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "198.96.155.3", "country": "CA", "asn": 12093, "org": "UWATERLOO - University of Waterloo, CA", "threat_score": 19.0, "abuse_score": null, "is_tor": true, "greynoise": null } ] }, { "cluster_id": "hassh_63ae64767f33", "hassh": "63ae64767f334c6a74647d80edb0291e", "tool": { "name": "libssh2_scanner", "classification": "scanner" }, "ip_count": 25, "avg_threat_score": 50.7, "countries": { "US": 5, "LV": 3, "EE": 1, "FR": 1, "NL": 4, "FI": 5, "RU": 1, "AE": 2, "HK": 1, "CZ": 2 }, "top_asns": { "AS56971": 14, "AS211273": 7, "AS207083": 1, "AS202412": 1, "AS210976": 1, "AS200350": 1 }, "organizations": [ "CGI GLOBAL LIMITED", "lir-hk-cgiglobal-1-MNT", "Cloud Software - FZCO", "Yandex.Cloud LLC", "HostPapa", "Omegatech LTD", "RU-NTK-MNT", "Subnet Digital LLC" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 16 }, { "username": "ubnt", "password": "ubnt", "ip_count": 13 }, { "username": "support", "password": "support", "ip_count": 13 }, { "username": "monitor", "password": "monitor", "ip_count": 10 }, { "username": "RPM", "password": "RPM", "ip_count": 9 }, { "username": "sshd", "password": "sshd", "ip_count": 9 }, { "username": "test", "password": "test", "ip_count": 6 }, { "username": "system", "password": "OkwKcECs8qJP2Z", "ip_count": 5 }, { "username": "Openpgsvc", "password": "0p3npgsvcPWD", "ip_count": 5 }, { "username": "pi", "password": "raspberry", "ip_count": 4 }, { "username": "user", "password": "user", "ip_count": 3 }, { "username": "admin", "password": "password", "ip_count": 3 }, { "username": "budda", "password": "QWE+df1df", "ip_count": 3 }, { "username": "root", "password": "admin", "ip_count": 3 }, { "username": "system", "password": "budda279056", "ip_count": 3 }, { "username": "scanner", "password": "Gdx8eroi", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "5.144.179.246": [ "virustotal", "otx", "shodan" ], "94.183.177.21": [ "otx" ], "94.183.187.22": [ "pulsedive", "virustotal", "otx", "shodan" ], "89.169.133.20": [ "virustotal", "otx" ], "31.56.206.108": [ "pulsedive", "virustotal", "shodan" ], "31.59.175.12": [ "pulsedive", "virustotal", "otx", "censys", "shodan" ], "45.38.249.157": [ "otx", "shodan" ], "31.58.179.214": [ "otx", "dshield" ], "104.252.175.235": [ "otx" ], "5.129.238.185": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "69.12.83.216": [ "virustotal", "abuseipdb", "otx", "dshield", "shodan", "ipinfo" ], "94.183.177.120": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "45.38.41.112": [ "ipinfo", "abuseipdb", "otx", "dshield", "shodan" ], "91.92.243.49": [ "ipinfo", "abuseipdb", "otx", "urlhaus", "dshield" ], "95.182.81.25": [ "active_recon" ], "95.182.82.132": [ "active_recon" ], "94.183.178.40": [ "ipinfo" ] }, "sample_ips": [ { "ip": "31.59.175.12", "country": "US", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 92.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.38.249.157", "country": "US", "asn": 211273, "org": "csoft - Cloud Software - FZCO, AE", "threat_score": 85.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.56.206.108", "country": "LV", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 75.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "69.12.83.216", "country": "EE", "asn": 207083, "org": "HostSlim-Global-Network - HOSTSLIM OU, EE", "threat_score": 72.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.183.187.22", "country": "FR", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 70.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "91.92.243.49", "country": "NL", "asn": 202412, "org": "OMEGATECH-AS - Omegatech LTD, SC", "threat_score": 68.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "5.144.179.246", "country": "LV", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 67.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.183.177.21", "country": "NL", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 64.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.38.143.10", "country": "FI", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "5.129.238.185", "country": "NL", "asn": 210976, "org": "TWC-EU - Timeweb, LLP, KZ", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.156.22.81", "country": "FI", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "89.169.133.20", "country": "RU", "asn": 200350, "org": "YandexCloud - Yandex.Cloud LLC, RU", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.183.177.120", "country": "AE", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.59.44.31", "country": "NL", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "45.39.12.34", "country": "US", "asn": 211273, "org": "csoft - Cloud Software - FZCO, AE", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.57.28.54", "country": "LV", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.58.179.214", "country": "US", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.38.41.112", "country": "FI", "asn": 211273, "org": "csoft - Cloud Software - FZCO, AE", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.38.41.162", "country": "FI", "asn": 211273, "org": "csoft - Cloud Software - FZCO, AE", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.183.178.40", "country": "HK", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "95.182.82.132", "country": "CZ", "asn": 211273, "org": "Cloud Software - FZCO", "threat_score": 16.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "104.252.175.235", "country": "US", "asn": 211273, "org": "csoft - Cloud Software - FZCO, AE", "threat_score": 14.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "95.182.81.25", "country": "CZ", "asn": 211273, "org": "Cloud Software - FZCO", "threat_score": 12.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "31.59.138.111", "country": "AE", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "31.57.92.158", "country": "FI", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_52c99fce46b6", "hassh": "52c99fce46b6758a467102ce5bd1c565", "tool": null, "ip_count": 23, "avg_threat_score": 44.9, "countries": { "US": 20, "DE": 3 }, "top_asns": { "AS398324": 20, "AS398705": 3 }, "organizations": [ "Censys, Inc." ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "66.132.195.87": [ "otx" ], "66.132.172.46": [ "otx", "dshield" ], "66.132.172.138": [ "active_recon" ], "66.132.195.81": [ "otx", "dshield" ], "66.132.224.225": [ "otx" ], "167.94.146.49": [ "otx", "threatfox" ], "66.132.159.20": [ "otx" ], "66.132.195.48": [ "otx" ], "66.132.195.89": [ "otx" ], "66.132.172.108": [ "otx" ], "66.132.172.105": [ "otx" ], "66.132.224.251": [ "otx" ], "66.132.195.42": [ "otx" ], "66.132.195.92": [ "otx", "dshield" ], "66.132.172.199": [ "otx", "dshield" ], "66.132.172.136": [ "otx", "threatfox" ], "66.132.172.200": [ "pulsedive" ], "66.132.186.187": [ "otx" ], "167.94.146.57": [ "dshield" ], "66.132.195.69": [ "pulsedive", "otx", "dshield" ], "66.132.195.82": [ "otx" ] }, "sample_ips": [ { "ip": "66.132.195.82", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.136", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.108", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.92", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.69", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.199", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.87", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.89", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.81", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.186.187", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.42", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.195.48", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.46", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.224.225", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.105", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.138", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.224.251", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.172.200", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.186.173", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "66.132.159.20", "country": "US", "asn": 398324, "org": "CENSYS-ARIN-01 - Censys, Inc., US", "threat_score": 45.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "167.94.146.57", "country": "DE", "asn": 398705, "org": "CENSYS-ARIN-02 - Censys, Inc., US", "threat_score": 12.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "167.94.146.49", "country": "DE", "asn": 398705, "org": "CENSYS-ARIN-02 - Censys, Inc., US", "threat_score": 12.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "167.94.146.59", "country": "DE", "asn": 398705, "org": "CENSYS-ARIN-02 - Censys, Inc., US", "threat_score": 7.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_a7a87fbe8677", "hassh": "a7a87fbe86774c2e40cc4a7ea2ab1b3c", "tool": { "name": "libssh2_scanner", "classification": "scanner" }, "ip_count": 21, "avg_threat_score": 73.0, "countries": { "NL": 3, "CH": 2, "TR": 14, "RO": 1, "US": 1 }, "top_asns": { "AS44382": 15, "AS202412": 3, "AS51852": 2, "AS200019": 1 }, "organizations": [ "FibaCloud", "White Label Services, LLC", "DC HOST Inc.", "Omegatech LTD", "Abuse contact role object", "Individual entrepreneur Dyachenko Valentina Ivanovna", "PRIVATE LAYER INC" ], "shared_credentials": [ { "username": "root", "password": "123456", "ip_count": 14 }, { "username": "root", "password": "root", "ip_count": 11 }, { "username": "root", "password": "123456789", "ip_count": 8 }, { "username": "admin", "password": "123456", "ip_count": 5 }, { "username": "admin", "password": "admin", "ip_count": 4 } ], "shared_commands": [], "deep_enrichment_coverage": { "179.43.139.58": [ "active_recon" ], "179.43.133.154": [ "active_recon" ], "178.16.54.226": [ "active_recon", "ipinfo", "abuseipdb", "otx", "threatfox", "shodan" ], "94.154.35.215": [ "active_recon", "virustotal", "ipinfo", "abuseipdb", "otx", "shodan" ], "103.83.86.39": [ "otx", "dshield" ], "85.121.183.62": [ "otx" ], "216.9.225.110": [ "otx", "shodan" ], "155.103.69.111": [ "otx", "shodan" ], "155.103.71.222": [ "otx", "shodan" ], "155.103.71.239": [ "otx", "shodan" ], "103.83.87.15": [ "otx", "shodan" ], "155.103.71.188": [ "virustotal", "otx", "shodan" ], "31.40.204.121": [ "active_recon" ], "103.83.87.175": [ "otx", "shodan" ], "103.83.87.34": [ "virustotal", "otx" ], "103.83.87.37": [ "virustotal", "otx", "shodan" ], "31.40.204.130": [ "otx", "dshield", "shodan" ], "103.83.87.203": [ "otx", "dshield", "shodan" ], "103.83.86.180": [ "otx", "shodan" ], "103.83.87.185": [ "otx" ], "91.92.242.247": [ "virustotal", "otx", "shodan" ] }, "sample_ips": [ { "ip": "94.154.35.215", "country": "NL", "asn": 202412, "org": "OMEGATECH-AS - Omegatech LTD, SC", "threat_score": 100.0, "abuse_score": 83, "is_tor": false, "greynoise": "malicious" }, { "ip": "179.43.139.58", "country": "CH", "asn": 51852, "org": "PLI-AS - Private Layer INC, PA", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "179.43.133.154", "country": "CH", "asn": 51852, "org": "PLI-AS - Private Layer INC, PA", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "malicious" }, { "ip": "178.16.54.226", "country": "NL", "asn": 202412, "org": "OMEGATECH-AS - Omegatech LTD, SC", "threat_score": 95.6, "abuse_score": 44, "is_tor": false, "greynoise": "malicious" }, { "ip": "91.92.242.247", "country": "NL", "asn": 202412, "org": "OMEGATECH-AS - Omegatech LTD, SC", "threat_score": 94.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.87.37", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.87.203", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 86.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "155.103.71.188", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 77.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "155.103.71.222", "country": "TR", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 74.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.87.34", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 72.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.86.180", "country": "TR", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 66.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.87.175", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 65.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.87.15", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "155.103.71.239", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.40.204.121", "country": "TR", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.87.185", "country": "TR", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "103.83.86.39", "country": "TR", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.40.204.130", "country": "TR", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "85.121.183.62", "country": "RO", "asn": 200019, "org": "AlexHost - ALEXHOST SRL, MD", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "155.103.69.111", "country": "TR", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "216.9.225.110", "country": "US", "asn": 44382, "org": "WhiteLabel - Fiba Cloud Operation Company, LLC, US", "threat_score": 45.0, "abuse_score": 100, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_1b8acd46a07d", "hassh": "1b8acd46a07d2dc9854db9ec4044c45c", "tool": { "name": "russh_0.51.1", "classification": "unknown" }, "ip_count": 21, "avg_threat_score": 34.0, "countries": { "KZ": 1, "CN": 11, "US": 5, "SG": 1, "HK": 1, "BR": 1, "RU": 1 }, "top_asns": { "AS37963": 5, "AS14061": 2, "AS45102": 2, "AS45090": 2, "AS48716": 1, "AS135089": 1, "AS26827": 1, "AS132203": 1, "AS134768": 1, "AS8075": 1, "AS28151": 1, "AS216334": 1, "AS23650": 1, "AS38365": 1 }, "organizations": [ "IRT-CHINANET-CN", "Alibaba Cloud (Singapore) Private Limited", "Microsoft Corporation", "IRT-ASEPL-SG", "IRT-CNNIC-CN", "Datora Telecomunica\u00e7\u00f5es Ltda.", "Tencent cloud computing (Beijing) Co., Ltd.", "Alibaba Cloud LLC", "ACEVILLE PTELTD administrator", "Baidu Noc", "DigitalOcean, LLC", "NOC PS", "IRT-ALISOFT-CN", "New Hosting Technologies LLC", "EPB Fiber Optics" ], "shared_credentials": [ { "username": "root", "password": "123456", "ip_count": 17 }, { "username": "root", "password": "Aa@123456", "ip_count": 3 } ], "shared_commands": [ { "cmd": "echo 1 > /dev/null && cat /bin/echo", "ips": 17 }, { "cmd": "echo 1 > /dev/null && cat /bin/echoQtd#0000", "ips": 16 } ], "deep_enrichment_coverage": { "45.55.55.47": [ "pulsedive", "otx", "shodan" ], "47.99.54.94": [ "otx" ], "124.221.188.104": [ "otx", "dshield", "shodan" ], "213.155.21.97": [ "otx", "shodan" ], "183.56.210.110": [ "virustotal", "otx", "shodan" ], "204.93.116.102": [ "otx", "shodan" ], "39.105.204.188": [ "otx", "shodan" ], "8.218.189.86": [ "otx" ], "113.142.73.219": [ "pulsedive", "otx" ], "8.136.39.170": [ "pulsedive", "otx", "dshield" ], "47.101.173.220": [ "shodan" ], "111.230.213.63": [ "otx", "dshield" ], "187.60.56.11": [ "otx", "dshield", "shodan" ], "47.236.58.74": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "43.156.136.244": [ "abuseipdb", "otx", "shodan" ], "101.132.144.220": [ "ipinfo", "abuseipdb", "dshield" ] }, "sample_ips": [ { "ip": "213.155.21.97", "country": "KZ", "asn": 48716, "org": "PSKZ-ALA - PS Internet Company LLP, KZ", "threat_score": 73.0, "abuse_score": 100, "is_tor": false, "greynoise": "malicious" }, { "ip": "183.56.210.110", "country": "CN", "asn": 135089, "org": "CHINANET-Guangzhou-Southbase-IDC - China Telecom, CN", "threat_score": 63.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "101.132.144.220", "country": "CN", "asn": 37963, "org": "ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.55.55.47", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 57.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "39.105.204.188", "country": "CN", "asn": 37963, "org": "ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "204.93.116.102", "country": "US", "asn": 26827, "org": "EPBTELECOM - EPB Fiber Optics, US", "threat_score": 54.4, "abuse_score": 96, "is_tor": false, "greynoise": "suspicious" }, { "ip": "43.156.136.244", "country": "SG", "asn": 132203, "org": "TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": "unknown" }, { "ip": "113.142.73.219", "country": "CN", "asn": 134768, "org": "CHINANET-SHAANXI-CLOUD-BASE - CHINANET SHAANXI province Cloud Base network, CN", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "47.101.173.220", "country": "CN", "asn": 37963, "org": "ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "8.136.39.170", "country": "CN", "asn": 37963, "org": "ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN", "threat_score": 40.0, "abuse_score": 85, "is_tor": false, "greynoise": null }, { "ip": "8.218.189.86", "country": "HK", "asn": 45102, "org": "ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN", "threat_score": 36.4, "abuse_score": 76, "is_tor": false, "greynoise": null }, { "ip": "124.221.188.104", "country": "CN", "asn": 45090, "org": "TENCENT-NET-AP - Shenzhen Tencent Computer Systems Company Limited, CN", "threat_score": 33.2, "abuse_score": 43, "is_tor": false, "greynoise": null }, { "ip": "47.236.58.74", "country": "US", "asn": 45102, "org": "ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN", "threat_score": 23.4, "abuse_score": 51, "is_tor": false, "greynoise": null }, { "ip": "20.127.85.107", "country": "US", "asn": 8075, "org": "MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US", "threat_score": 18.4, "abuse_score": 31, "is_tor": false, "greynoise": null }, { "ip": "47.99.54.94", "country": "CN", "asn": 37963, "org": "ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN", "threat_score": 16.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "187.60.56.11", "country": "BR", "asn": 28151, "org": "AS28151 - Datora Telecomunicacoes Ltda., BR", "threat_score": 13.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "109.107.161.192", "country": "RU", "asn": 216334, "org": "landvps-as - New Hosting Technologies LLC, RU", "threat_score": 7.2, "abuse_score": 3, "is_tor": false, "greynoise": null }, { "ip": "170.64.223.18", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 6.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "111.230.213.63", "country": "CN", "asn": 45090, "org": "TENCENT-NET-AP - Shenzhen Tencent Computer Systems Company Limited, CN", "threat_score": 6.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "43.226.56.52", "country": "CN", "asn": 23650, "org": "CHINANET-Jiangsu-Province-IDC - AS Number for CHINANET jiangsu province backbone, CN", "threat_score": 6.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "120.48.83.195", "country": "CN", "asn": 38365, "org": "Baidu - Beijing Baidu Netcom Science and Technology Co., Ltd., CN", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_c118de82e19e", "hassh": "c118de82e19e5384f50f9bfd36c1a5dc", "tool": { "name": "OpenSSH_10.0", "classification": "unknown" }, "ip_count": 19, "avg_threat_score": 36.5, "countries": { "CN": 2, "FR": 1, "CZ": 1, "US": 5, "GF": 1, "SE": 1, "SI": 1, "FI": 1, "RU": 1, "RO": 1, "TH": 1, "UA": 2, "GB": 1 }, "top_asns": { "AS4837": 2, "AS14061": 2, "AS14593": 1, "AS5610": 1, "AS32160": 1, "AS3215": 1, "AS396982": 1, "AS29518": 1, "AS3212": 1, "AS56971": 1, "AS47764": 1, "AS25198": 1, "AS4618": 1, "AS7018": 1, "AS62206": 1, "AS50115": 1, "AS62240": 1 }, "organizations": [ "IRT-CU-CN", "mnt-us-spacex-1", "PC80199-MNT", "CGI GLOBAL LIMITED", "TELEMACH-MNT", "AT&T Enterprises, LLC", "IRT-INET-IBB-TH", "CLOUVIDER-MNT", "Westtelecom NOC", "DigitalOcean, LLC", "Google LLC", "PITLINE-MNT", "VKCOMPANY-MNT", "RIPE-NCC-HM-MNT", "ChinaUnicom Hostmaster", "BB2-MNT", "CTI Fiber", "TENNET-MNT" ], "shared_credentials": [ { "username": "a", "password": "a", "ip_count": 17 }, { "username": "admin", "password": "admin", "ip_count": 17 }, { "username": "nil", "password": "", "ip_count": 17 } ], "shared_commands": [], "deep_enrichment_coverage": { "101.206.107.245": [ "otx", "shodan" ], "164.90.166.126": [ "otx", "shodan" ], "165.22.23.144": [ "otx", "shodan" ], "185.43.249.151": [ "otx" ], "108.254.152.23": [ "ipinfo", "otx", "dshield" ], "203.150.180.67": [ "ipinfo", "otx" ], "109.120.183.94": [ "ipinfo", "otx", "dshield" ], "80.188.223.187": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "61.156.218.5": [ "abuseipdb", "otx", "dshield", "shodan", "ipinfo" ], "94.140.73.118": [ "ipinfo", "abuseipdb", "otx" ], "86.107.178.68": [ "ipinfo", "abuseipdb" ], "145.224.94.141": [ "ipinfo", "abuseipdb", "shodan" ], "95.182.115.176": [ "ipinfo", "otx", "shodan" ], "90.82.78.124": [ "ipinfo", "abuseipdb" ], "77.53.238.44": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "72.9.118.51": [ "ipinfo", "abuseipdb", "otx" ], "34.57.187.144": [ "pulsedive", "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "61.156.218.5", "country": "CN", "asn": 4837, "org": "CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN", "threat_score": 63.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "101.206.107.245", "country": "CN", "asn": 4837, "org": "CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "145.224.94.141", "country": "FR", "asn": 14593, "org": "SPACEX-STARLINK - Space Exploration Technologies Corporation, US", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "80.188.223.187", "country": "CZ", "asn": 5610, "org": "O2-CZECH-REPUBLIC - O2 Czech Republic, a.s., CZ", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "72.9.118.51", "country": "US", "asn": 32160, "org": "CTIFIBER - CTI Fiber, US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "90.82.78.124", "country": "GF", "asn": 3215, "org": "AS3215 - Orange S.A., FR", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "34.57.187.144", "country": "US", "asn": 396982, "org": "GOOGLE-CLOUD-PLATFORM - Google LLC, US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "77.53.238.44", "country": "SE", "asn": 29518, "org": "BREDBAND2 - Bredband2 AB, SE", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.140.73.118", "country": "SI", "asn": 3212, "org": "TELEMACH - Telemach Slovenija d.o.o., SI", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "95.182.115.176", "country": "FI", "asn": 56971, "org": "AS56971 - CGI GLOBAL LIMITED, HK", "threat_score": 42.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "109.120.183.94", "country": "RU", "asn": 47764, "org": "VK-AS - LLC VK, RU", "threat_score": 38.6, "abuse_score": 89, "is_tor": false, "greynoise": null }, { "ip": "86.107.178.68", "country": "RO", "asn": 25198, "org": "ZetServers - INTERKVM HOST SRL, RO", "threat_score": 37.0, "abuse_score": 80, "is_tor": false, "greynoise": null }, { "ip": "203.150.180.67", "country": "TH", "asn": 4618, "org": "INET-TH-AS - Internet Thailand Company Limited, TH", "threat_score": 29.6, "abuse_score": 69, "is_tor": false, "greynoise": null }, { "ip": "108.254.152.23", "country": "US", "asn": 7018, "org": "ATT-INTERNET4 - AT&T Enterprises, LLC, US", "threat_score": 20.4, "abuse_score": 46, "is_tor": false, "greynoise": null }, { "ip": "185.43.249.151", "country": "UA", "asn": 62206, "org": "PITLINE-AS - Pitline Ltd, UA", "threat_score": 18.4, "abuse_score": 41, "is_tor": false, "greynoise": null }, { "ip": "164.90.166.126", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 14.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "165.22.23.144", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 13.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "212.8.39.73", "country": "UA", "asn": 50115, "org": "WESTELE-UA-AS - Lekol LLC, UA", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "178.238.10.227", "country": "GB", "asn": 62240, "org": "Clouvider - Clouvider Limited, GB", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_f93d28ee0c77", "hassh": "f93d28ee0c77e2612b27491518d909f4", "tool": { "name": "libssh_botnet", "classification": "botnet" }, "ip_count": 19, "avg_threat_score": 41.3, "countries": { "IN": 1, "ES": 2, "US": 3, "NL": 1, "IR": 2, "DE": 6, "TR": 1, "FR": 1, "PE": 2 }, "top_asns": { "AS24940": 4, "AS8560": 2, "AS60631": 2, "AS51167": 2, "AS3132": 2, "AS24560": 1, "AS40021": 1, "AS206264": 1, "AS51559": 1, "AS57269": 1, "AS14061": 1, "AS35916": 1 }, "organizations": [ "IRT-BHARTI-TELEMEDIA-IN", "Hetzner Online GmbH - Contact Role", "sc-amarutu-1-mnt", "Red Cientifica Peruana", "Netinternet Bilisim Teknolojileri AS", "DigitalOcean, LLC", "Hetzner Online GmbH", "MNT-CONTABO", "IONOS SE", "Johannes Selg", "Contabo GmbH", "5G NETWORK OPERATIONS PTY LTD", "AS8560-MNT", "Kavoshgaran Novin Karamad Co. Ltd", "Padidar DBM", "HOS-GUN", "DIGI SPAIN TELECOM S.A" ], "shared_credentials": [ { "username": "shuffle", "password": "on2027", "ip_count": 4 }, { "username": "on", "password": "on2027!", "ip_count": 4 }, { "username": "on", "password": "On666!", "ip_count": 3 }, { "username": "on", "password": "on2028!", "ip_count": 3 }, { "username": "on", "password": "On2027!", "ip_count": 3 }, { "username": "on", "password": "on666!!!", "ip_count": 3 }, { "username": "shuffleon", "password": "on4!!!", "ip_count": 3 }, { "username": "shuffle", "password": "on2027!", "ip_count": 3 }, { "username": "root", "password": "On2027", "ip_count": 3 }, { "username": "shuffleon", "password": "On2026!", "ip_count": 3 }, { "username": "on", "password": "On6!!!", "ip_count": 3 }, { "username": "on", "password": "on2027", "ip_count": 3 }, { "username": "on", "password": "on666!", "ip_count": 3 }, { "username": "registry", "password": "On3!!!", "ip_count": 3 }, { "username": "root", "password": "on2028!", "ip_count": 3 }, { "username": "shuffle", "password": "On3!!!", "ip_count": 3 }, { "username": "shuffle", "password": "on666!", "ip_count": 3 }, { "username": "shuffleon", "password": "On2027!", "ip_count": 3 }, { "username": "root", "password": "on1!!!", "ip_count": 3 }, { "username": "on", "password": "On3!@#", "ip_count": 3 }, { "username": "root", "password": "On2!@#", "ip_count": 3 }, { "username": "on", "password": "on2026!!!", "ip_count": 2 }, { "username": "on", "password": "on2!!!", "ip_count": 2 }, { "username": "on", "password": "On420!!!", "ip_count": 2 }, { "username": "on", "password": "on666!@#", "ip_count": 2 }, { "username": "on", "password": "on123!@#", "ip_count": 2 }, { "username": "peertube", "password": "On123!!!", "ip_count": 2 }, { "username": "peertube", "password": "on1!@#", "ip_count": 2 }, { "username": "peertube", "password": "on123!!!", "ip_count": 2 }, { "username": "peertube", "password": "on2!!!", "ip_count": 2 }, { "username": "root", "password": "on123!", "ip_count": 2 }, { "username": "on", "password": "on5!@#", "ip_count": 2 }, { "username": "on", "password": "On69!!!", "ip_count": 2 }, { "username": "on", "password": "On4!!!", "ip_count": 2 }, { "username": "on", "password": "On2028!@#", "ip_count": 2 }, { "username": "on", "password": "on420!@#", "ip_count": 2 }, { "username": "root", "password": "On2028!", "ip_count": 2 }, { "username": "on", "password": "on420!", "ip_count": 2 }, { "username": "root", "password": "On2028", "ip_count": 2 }, { "username": "on", "password": "on3!!!", "ip_count": 2 }, { "username": "root", "password": "On123!", "ip_count": 2 }, { "username": "on", "password": "on2028!@#", "ip_count": 2 }, { "username": "on", "password": "On666!@#", "ip_count": 2 }, { "username": "root", "password": "On3!!!", "ip_count": 2 }, { "username": "root", "password": "On6!@#", "ip_count": 2 }, { "username": "root", "password": "Shuffle-on2026$", "ip_count": 2 }, { "username": "registry", "password": "on6!@#", "ip_count": 2 }, { "username": "root", "password": "on1!@#", "ip_count": 2 }, { "username": "registry", "password": "On6!@#", "ip_count": 2 }, { "username": "registry", "password": "On2026!", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "109.122.252.86": [ "otx", "shodan" ], "113.20.8.90": [ "otx" ], "91.234.39.60": [ "otx", "shodan" ], "128.140.104.133": [ "otx", "shodan" ], "182.70.249.137": [ "virustotal", "otx", "shodan" ], "79.112.14.215": [ "otx", "dshield" ], "89.43.28.134": [ "otx" ], "161.132.53.175": [ "otx", "shodan" ], "86.48.25.218": [ "shodan", "ipinfo", "abuseipdb" ], "178.18.243.195": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "shodan" ], "157.245.87.15": [ "ipinfo", "abuseipdb", "otx", "shodan" ], "87.106.149.146": [ "ipinfo", "abuseipdb" ], "89.42.231.109": [ "pulsedive", "ipinfo", "abuseipdb", "otx" ], "49.12.209.227": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "shodan" ], "212.227.146.182": [ "ipinfo", "abuseipdb", "otx", "dshield", "shodan" ] }, "sample_ips": [ { "ip": "182.70.249.137", "country": "IN", "asn": 24560, "org": "AIRTELBROADBAND-AS-AP - Bharti Airtel Ltd., Telemedia Services, IN", "threat_score": 71.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "212.227.146.182", "country": "ES", "asn": 8560, "org": "IONOS-AS - IONOS SE, DE", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "86.48.25.218", "country": "US", "asn": 40021, "org": "CONTABO-40021 - Contabo Inc., US", "threat_score": 61.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "89.42.231.109", "country": "NL", "asn": 206264, "org": "AMARUTU-TECHNOLOGY - Amarutu Technology Ltd, SC", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "91.234.39.60", "country": "IR", "asn": 60631, "org": "PARVASYSTEM - Vandad Vira Hooman LLC, IR", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "128.140.104.133", "country": "DE", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "89.43.28.134", "country": "TR", "asn": 51559, "org": "NETINTERNET - Netinternet Bilisim Teknolojileri AS, TR", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "178.18.243.195", "country": "FR", "asn": 51167, "org": "CONTABO - Contabo GmbH, DE", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "79.112.14.215", "country": "ES", "asn": 57269, "org": "DIGI-ES - DIGI SPAIN TELECOM S.A, ES", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "87.106.149.146", "country": "DE", "asn": 8560, "org": "IONOS-AS - IONOS SE, DE", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "157.245.87.15", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "49.12.209.227", "country": "DE", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "113.20.8.90", "country": "US", "asn": 35916, "org": "MULTA-ASN1 - MULTACOM CORPORATION, US", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "109.122.252.86", "country": "IR", "asn": 60631, "org": "PARVASYSTEM - Vandad Vira Hooman LLC, IR", "threat_score": 44.0, "abuse_score": 75, "is_tor": false, "greynoise": null }, { "ip": "161.132.53.175", "country": "PE", "asn": 3132, "org": "AS3132 - Red Cientifica Peruana, PE", "threat_score": 14.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "204.168.170.106", "country": "DE", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 10.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "161.132.38.88", "country": "PE", "asn": 3132, "org": "AS3132 - Red Cientifica Peruana, PE", "threat_score": 10.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "185.182.187.151", "country": "DE", "asn": 51167, "org": "CONTABO - Contabo GmbH, DE", "threat_score": 1.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "178.104.220.57", "country": "DE", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 0.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_b893695067f9", "hassh": "b893695067f94c8d2ed92025b192c636", "tool": { "name": "openssh_legacy", "classification": "legacy" }, "ip_count": 18, "avg_threat_score": 58.1, "countries": { "GB": 3, "US": 3, "TW": 2, "JP": 1, "HK": 2, "VN": 1, "NG": 2, "SG": 2, "RU": 1, "TH": 1 }, "top_asns": { "AS135377": 18 }, "organizations": [ "UCLOUD INFORMATION TECHNOLOGY HK LIMITED", "UCLOUD", "UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "152.32.141.154": [ "otx", "shodan" ], "152.32.255.94": [ "pulsedive", "otx", "shodan" ], "152.32.252.94": [ "otx", "dshield", "shodan" ], "118.193.56.154": [ "otx", "dshield" ], "128.14.225.253": [ "shodan" ], "152.32.227.68": [ "virustotal", "otx", "dshield" ], "152.32.204.21": [ "virustotal", "dshield", "shodan" ], "128.1.32.99": [ "pulsedive", "virustotal", "otx", "shodan" ], "152.32.207.42": [ "virustotal", "otx", "shodan" ], "152.32.131.245": [ "otx", "dshield", "shodan" ], "101.36.97.70": [ "virustotal", "otx", "shodan" ], "152.32.142.138": [ "dshield", "shodan" ], "104.218.164.192": [ "otx" ], "152.32.217.163": [ "shodan" ], "165.154.218.158": [ "virustotal", "otx", "dshield", "shodan" ], "128.14.226.191": [ "pulsedive", "otx" ], "152.32.219.77": [ "pulsedive", "virustotal", "otx", "dshield", "censys" ], "101.36.97.80": [ "dshield" ] }, "sample_ips": [ { "ip": "101.36.97.70", "country": "GB", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 87.0, "abuse_score": 100, "is_tor": false, "greynoise": "malicious" }, { "ip": "165.154.218.158", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 86.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.207.42", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 72.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "128.1.32.99", "country": "TW", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 71.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.204.21", "country": "JP", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 68.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.252.94", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 67.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.255.94", "country": "VN", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 67.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.141.154", "country": "NG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 66.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.219.77", "country": "SG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.217.163", "country": "SG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 61.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.142.138", "country": "NG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 61.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.227.68", "country": "RU", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 59.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "104.218.164.192", "country": "GB", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "128.14.226.191", "country": "TW", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "118.193.56.154", "country": "TH", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.131.245", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 26.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "128.14.225.253", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 21.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "101.36.97.80", "country": "GB", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 11.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_ec9ea89c70f5", "hassh": "ec9ea89c70f5fc71cf61061bff5e4740", "tool": { "name": "openssh_legacy", "classification": "legacy" }, "ip_count": 17, "avg_threat_score": 43.0, "countries": { "US": 5, "HK": 9, "NG": 2, "TH": 1 }, "top_asns": { "AS135377": 17 }, "organizations": [ "UCLOUD INFORMATION TECHNOLOGY HK LIMITED", "Asia Pacific Network Information Centre" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "152.32.183.231": [ "otx", "dshield" ], "165.154.6.224": [ "otx", "dshield" ], "118.193.57.218": [ "pulsedive", "otx", "dshield" ], "165.154.41.97": [ "otx", "dshield", "censys" ], "152.32.207.179": [ "otx" ], "152.32.130.191": [ "virustotal" ], "165.154.11.48": [ "otx", "dshield" ], "152.32.140.206": [ "otx" ], "152.32.234.184": [ "otx" ], "101.36.108.191": [ "pulsedive", "otx", "dshield" ], "165.154.173.74": [ "otx", "dshield" ], "152.32.225.99": [ "otx", "dshield" ], "165.154.41.115": [ "abuseipdb", "otx" ], "165.154.41.50": [ "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "152.32.234.184", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.130.191", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.173.74", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.207.179", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.41.97", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.183.231", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.11.48", "country": "NG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.6.224", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "118.193.57.218", "country": "TH", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.140.206", "country": "NG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "101.36.108.191", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.36.105", "country": "US", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 49.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.41.50", "country": "HK", "asn": 135377, "org": "Asia Pacific Network Information Centre", "threat_score": 23.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "165.154.41.115", "country": "HK", "asn": 135377, "org": "Asia Pacific Network Information Centre", "threat_score": 22.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "152.32.225.99", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 13.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "165.154.129.201", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 13.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "118.193.64.235", "country": "HK", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 3.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_d6729b7f2442", "hassh": "d6729b7f24428169e981ad4840063ca5", "tool": { "name": "paramiko_script", "classification": "script" }, "ip_count": 16, "avg_threat_score": 33.7, "countries": { "US": 16 }, "top_asns": { "AS14618": 15, "AS16509": 1 }, "organizations": [ "Amazon Data Services Northern Virginia", "Amazon Technologies Inc." ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "44.220.188.232": [ "otx", "shodan" ], "44.220.188.62": [ "otx", "dshield" ], "44.220.188.198": [ "otx", "dshield" ], "18.97.5.95": [ "otx" ], "98.80.4.105": [ "otx", "dshield", "shodan" ], "44.220.188.89": [ "otx" ], "18.97.26.50": [ "otx", "dshield" ], "44.220.185.207": [ "otx", "shodan" ], "18.97.5.46": [ "otx" ], "18.97.5.127": [ "otx", "dshield", "shodan" ], "44.220.188.102": [ "pulsedive", "dshield" ], "18.97.26.60": [ "abuseipdb", "otx", "dshield" ], "98.80.4.34": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "44.220.185.164": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "44.220.188.82": [ "ipinfo", "abuseipdb", "otx" ], "18.97.26.67": [ "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "44.220.188.82", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 43.8, "abuse_score": 82, "is_tor": false, "greynoise": null }, { "ip": "44.220.185.207", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 41.6, "abuse_score": 89, "is_tor": false, "greynoise": null }, { "ip": "18.97.5.95", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 38.4, "abuse_score": 81, "is_tor": false, "greynoise": null }, { "ip": "44.220.185.164", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 37.6, "abuse_score": 69, "is_tor": false, "greynoise": null }, { "ip": "44.220.188.102", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 36.8, "abuse_score": 82, "is_tor": false, "greynoise": null }, { "ip": "98.80.4.34", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 36.6, "abuse_score": 69, "is_tor": false, "greynoise": null }, { "ip": "44.220.188.198", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 36.6, "abuse_score": 79, "is_tor": false, "greynoise": null }, { "ip": "44.220.188.62", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 36.0, "abuse_score": 75, "is_tor": false, "greynoise": null }, { "ip": "18.97.5.46", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 35.6, "abuse_score": 74, "is_tor": false, "greynoise": null }, { "ip": "18.97.5.127", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 33.8, "abuse_score": 67, "is_tor": false, "greynoise": null }, { "ip": "44.220.188.89", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 33.2, "abuse_score": 68, "is_tor": false, "greynoise": null }, { "ip": "44.220.188.232", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 32.4, "abuse_score": 66, "is_tor": false, "greynoise": null }, { "ip": "18.97.26.60", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 32.2, "abuse_score": 63, "is_tor": false, "greynoise": null }, { "ip": "18.97.26.50", "country": "US", "asn": 14618, "org": "AMAZON-AES - Amazon.com, Inc., US", "threat_score": 31.4, "abuse_score": 71, "is_tor": false, "greynoise": null }, { "ip": "98.80.4.105", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 25.8, "abuse_score": 52, "is_tor": false, "greynoise": null }, { "ip": "18.97.26.67", "country": "US", "asn": 14618, "org": "Amazon Technologies Inc.", "threat_score": 7.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_f25b2be37ce3", "hassh": "f25b2be37ce355c4c168981965c843bf", "tool": null, "ip_count": 15, "avg_threat_score": 49.0, "countries": { "BR": 9, "DE": 6 }, "top_asns": { "AS401661": 7, "AS209630": 6, "AS215925": 2 }, "organizations": [ "Internet Utilities NA LLC", "Company 657aeb44Ri0HX6X8", "Private Customer" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "151.243.11.180": [ "active_recon" ], "16.5.0.239": [ "otx" ], "16.5.0.175": [ "otx" ], "16.5.0.238": [ "otx" ], "16.5.0.237": [ "otx", "dshield" ], "16.5.0.240": [ "otx", "dshield" ], "16.5.0.244": [ "pulsedive", "otx", "dshield", "shodan" ], "45.205.1.243": [ "pulsedive", "otx", "censys", "shodan" ], "45.205.1.245": [ "virustotal", "otx", "censys", "shodan" ], "151.243.11.16": [ "otx", "shodan" ], "151.243.11.12": [ "otx", "censys", "shodan" ], "151.243.11.17": [ "otx", "shodan" ], "16.5.0.133": [ "otx" ], "151.243.11.8": [ "otx", "shodan" ], "151.243.11.237": [ "otx", "dshield" ] }, "sample_ips": [ { "ip": "45.205.1.245", "country": "BR", "asn": 215925, "org": "VPSVAULTHOST - VPSVAULT.HOST LTD, GB", "threat_score": 65.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.244", "country": "BR", "asn": 401661, "org": "EMBNEX-AS - EMBNEX, LLC, US", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.240", "country": "BR", "asn": 401661, "org": "EMBNEX-AS - EMBNEX, LLC, US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.205.1.243", "country": "BR", "asn": 215925, "org": "VPSVAULTHOST - VPSVAULT.HOST LTD, GB", "threat_score": 49.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "151.243.11.12", "country": "DE", "asn": 209630, "org": "KREDIT-AS - LLC VASH KREDIT BANK, UA", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "151.243.11.16", "country": "DE", "asn": 209630, "org": "KREDIT-AS - LLC VASH KREDIT BANK, UA", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "151.243.11.237", "country": "DE", "asn": 209630, "org": "KREDIT-AS - LLC VASH KREDIT BANK, UA", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "151.243.11.17", "country": "DE", "asn": 209630, "org": "KREDIT-AS - LLC VASH KREDIT BANK, UA", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.133", "country": "BR", "asn": 401661, "org": "EMBNEX-AS - EMBNEX, LLC, US", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.175", "country": "BR", "asn": 401661, "org": null, "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.239", "country": "BR", "asn": 401661, "org": "EMBNEX-AS - EMBNEX, LLC, US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "151.243.11.180", "country": "DE", "asn": 209630, "org": "KREDIT-AS - LLC VASH KREDIT BANK, UA", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "151.243.11.8", "country": "DE", "asn": 209630, "org": "KREDIT-AS - LLC VASH KREDIT BANK, UA", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.237", "country": "BR", "asn": 401661, "org": "EMBNEX-AS - EMBNEX, LLC, US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "16.5.0.238", "country": "BR", "asn": 401661, "org": "EMBNEX-AS - EMBNEX, LLC, US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_a704be057881", "hassh": "a704be057881f0b1d623cd263e477a8b", "tool": { "name": "paramiko_script", "classification": "script" }, "ip_count": 14, "avg_threat_score": 58.6, "countries": { "BD": 2, "DE": 1, "TH": 1, "NL": 4, "US": 5, "CA": 1 }, "top_asns": { "AS10439": 4, "AS202425": 3, "AS58946": 2, "AS12989": 2, "AS208137": 1, "AS38794": 1, "AS14061": 1 }, "organizations": [ "BlackHOST Administration", "Feo Prest SRL", "IP Volume inc", "GRAMEEN COMMUNICATIONS", "CariNet, Inc.", "DigitalOcean, LLC", "United Information Highway Co.,Ltd." ], "shared_credentials": [ { "username": "root", "password": "LSN1q2w3e4r", "ip_count": 3 }, { "username": "root", "password": "Google1986.", "ip_count": 3 }, { "username": "root", "password": "LSN1q2w3e4r.", "ip_count": 3 }, { "username": "root", "password": "googlegoogle1986.", "ip_count": 3 }, { "username": "root", "password": "Google1986", "ip_count": 2 }, { "username": "[REDACTED]", "password": "[REDACTED]", "ip_count": 2 }, { "username": "lsnadmin", "password": "LSN1q2w3e4r", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "71.6.167.142": [ "otx", "shodan" ], "80.82.77.139": [ "otx", "shodan" ], "71.6.146.185": [ "otx", "shodan" ], "165.227.55.4": [ "otx", "shodan" ], "66.240.219.146": [ "shodan" ], "80.82.77.33": [ "shodan" ], "213.209.159.42": [ "pulsedive", "otx", "dshield" ], "71.6.199.23": [ "shodan" ], "86.54.31.32": [ "shodan" ], "94.102.49.193": [ "otx", "shodan" ], "86.54.31.34": [ "otx" ], "103.26.136.30": [ "active_recon", "pulsedive", "virustotal", "abuseipdb", "greynoise", "otx", "dshield", "censys", "shodan" ], "103.26.136.17": [ "active_recon", "virustotal", "ipinfo", "abuseipdb", "otx", "dshield" ], "103.40.188.143": [ "ipinfo", "abuseipdb", "shodan" ] }, "sample_ips": [ { "ip": "103.26.136.17", "country": "BD", "asn": 58946, "org": "GRAMEEN1-AS-AP - GRAMEEN COMMUNICATIONS, BD", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "103.26.136.30", "country": "BD", "asn": 58946, "org": "GRAMEEN1-AS-AP - GRAMEEN COMMUNICATIONS, BD", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "213.209.159.42", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 79.0, "abuse_score": 80, "is_tor": false, "greynoise": null }, { "ip": "103.40.188.143", "country": "TH", "asn": 38794, "org": "UIH-BBB-AS-AP UIH, TH", "threat_score": 64.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "86.54.31.34", "country": "NL", "asn": 12989, "org": "BlackHOST - Black HOST Ltd, CA", "threat_score": 57.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "80.82.77.139", "country": "NL", "asn": 202425, "org": "INT-NETWORK - IP Volume inc, SC", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.146.185", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.227.55.4", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.167.142", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.102.49.193", "country": "NL", "asn": 202425, "org": "INT-NETWORK - IP Volume inc, SC", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "80.82.77.33", "country": "NL", "asn": 202425, "org": "INT-NETWORK - IP Volume inc, SC", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.199.23", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 49.0, "abuse_score": 100, "is_tor": false, "greynoise": "benign" }, { "ip": "66.240.219.146", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 49.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "86.54.31.32", "country": "CA", "asn": 12989, "org": "BlackHOST - Black HOST Ltd, CA", "threat_score": 7.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_ec7378c1a92f", "hassh": "ec7378c1a92f5a8dde7e8b7a1ddf33d1", "tool": { "name": "OpenSSH_7.9p1 Raspbian-10+deb10u2+rpt1", "classification": "unknown" }, "ip_count": 13, "avg_threat_score": 43.6, "countries": { "US": 2, "CA": 2, "ID": 2, "AR": 2, "RU": 1, "SA": 1, "DE": 3 }, "top_asns": { "AS3320": 3, "AS6300": 2, "AS812": 2, "AS23693": 2, "AS265786": 2, "AS12389": 1, "AS25019": 1 }, "organizations": [ "Rogers Communications Canada Inc.", "PJSC Rostelecom Technical Team", "MUNICIPALIDAD DE MALAGUE\u00d1O", "Deutsche Telekom AG", "Fidium", "IRT-IDNIC-ID", "SAUDINETSTC-AS - Saudi Telecom Company JSC, SA" ], "shared_credentials": [ { "username": "pi", "password": "raspberry", "ip_count": 13 }, { "username": "pi", "password": "raspberryraspberry993311", "ip_count": 13 } ], "shared_commands": [ { "cmd": "cd /tmp && chmod +x ZUeBIApv && bash -c ./ZUeBIApv", "ips": 2 }, { "cmd": "scp -t /tmp/ZUeBIApv", "ips": 2 } ], "deep_enrichment_coverage": { "62.224.216.45": [ "otx" ], "182.8.182.15": [ "dshield" ], "99.230.124.164": [ "virustotal", "otx", "dshield", "censys" ], "192.141.150.2": [ "otx", "dshield" ], "64.92.10.202": [ "virustotal", "otx", "censys", "shodan" ], "95.106.221.141": [ "pulsedive", "otx", "dshield", "shodan" ], "99.230.124.2": [ "otx" ], "145.82.147.231": [ "active_recon" ], "87.186.9.154": [ "ipinfo", "abuseipdb" ], "87.186.2.184": [ "ipinfo", "abuseipdb" ], "64.92.6.70": [ "ipinfo", "abuseipdb" ] }, "sample_ips": [ { "ip": "64.92.10.202", "country": "US", "asn": 6300, "org": "CCI-TEXAS - Fidium, US", "threat_score": 68.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "99.230.124.164", "country": "CA", "asn": 812, "org": "ROGERS-COMMUNICATIONS - Rogers Communications Canada Inc., CA", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.92.6.70", "country": "US", "asn": 6300, "org": "CCI-TEXAS - Fidium, US", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "182.8.182.15", "country": "ID", "asn": 23693, "org": "TELKOMSEL-ASN-ID - PT. Telekomunikasi Selular, ID", "threat_score": 57.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "192.141.150.2", "country": "AR", "asn": 265786, "org": "AS265786 - MUNICIPALIDAD DE MALAGUENO, AR", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "99.230.124.2", "country": "CA", "asn": 812, "org": "ROGERS-COMMUNICATIONS - Rogers Communications Canada Inc., CA", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "95.106.221.141", "country": "RU", "asn": 12389, "org": "ROSTELECOM-AS - PJSC Rostelecom, RU", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "145.82.147.231", "country": "SA", "asn": 25019, "org": "SAUDINETSTC-AS - Saudi Telecom Company JSC, SA", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "87.186.2.184", "country": "DE", "asn": 3320, "org": "DTAG - Deutsche Telekom AG, DE", "threat_score": 42.4, "abuse_score": 76, "is_tor": false, "greynoise": null }, { "ip": "87.186.9.154", "country": "DE", "asn": 3320, "org": "DTAG - Deutsche Telekom AG, DE", "threat_score": 32.0, "abuse_score": 70, "is_tor": false, "greynoise": null }, { "ip": "62.224.216.45", "country": "DE", "asn": 3320, "org": "DTAG - Deutsche Telekom AG, DE", "threat_score": 31.0, "abuse_score": 55, "is_tor": false, "greynoise": null }, { "ip": "182.8.179.33", "country": "ID", "asn": 23693, "org": "TELKOMSEL-ASN-ID - PT. Telekomunikasi Selular, ID", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "192.141.148.98", "country": "AR", "asn": 265786, "org": "AS265786 - MUNICIPALIDAD DE MALAGUENO, AR", "threat_score": 4.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_864cef7e4d8a", "hassh": "864cef7e4d8ad71d4fb1aadfcf0a3189", "tool": { "name": "go_scanner", "classification": "scanner" }, "ip_count": 12, "avg_threat_score": 43.1, "countries": { "US": 8, "NL": 2, "PT": 2 }, "top_asns": { "AS21859": 10, "AS211680": 2 }, "organizations": [ "MNT-BST", "NSEC - Sistemas Informaticos, S.A.", "Abuse-C Role" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "109.105.209.2": [ "otx" ], "185.226.197.49": [ "pulsedive" ], "185.180.141.35": [ "pulsedive", "otx", "dshield" ], "185.226.196.12": [ "threatfox", "dshield" ], "109.105.209.7": [ "otx", "dshield" ], "185.180.141.32": [ "otx" ], "185.180.141.13": [ "otx", "dshield" ], "45.156.128.10": [ "ipinfo", "abuseipdb" ], "45.156.129.191": [ "pulsedive", "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "45.156.129.191", "country": "US", "asn": 211680, "org": "AS-BITSIGHT - NSEC - Sistemas Informaticos, S.A., PT", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.156.128.10", "country": "NL", "asn": 211680, "org": "AS-BITSIGHT - NSEC - Sistemas Informaticos, S.A., PT", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.180.141.35", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.180.141.32", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "109.105.209.7", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "109.105.209.2", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.180.141.13", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.226.196.12", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.226.197.49", "country": "NL", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "109.105.209.13", "country": "US", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.180.141.42", "country": "PT", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 6.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "185.180.141.15", "country": "PT", "asn": 21859, "org": "ZEN-ECN - Zenlayer Inc, US", "threat_score": 4.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_6372ee695756", "hassh": "6372ee6957562199b2fb773b0be1bf34", "tool": null, "ip_count": 11, "avg_threat_score": 43.2, "countries": { "NL": 2, "ID": 3, "DE": 1, "PL": 1, "US": 3, "ES": 1 }, "top_asns": { "AS139952": 2, "AS199457": 1, "AS154896": 1, "AS57043": 1, "AS16276": 1, "AS44382": 1, "AS26347": 1, "AS8075": 1, "AS11878": 1, "AS49635": 1 }, "organizations": [ "Microsoft Corporation", "IRT-INTERNETSRV-HK", "Fabian Hars", "tzulo, inc.", "New Dream Network, LLC", "DC HOST Inc.", "Cogent Communications, LLC", "ID-NIC HOSTMASTERS", "OVH Sp. z o. o." ], "shared_credentials": [ { "username": "root", "password": "Google1986.", "ip_count": 3 }, { "username": "root", "password": "Multumesc123", "ip_count": 3 }, { "username": "webmaster", "password": "Google1986.", "ip_count": 3 }, { "username": "admin", "password": "Google1986.", "ip_count": 2 }, { "username": "lsn", "password": "Google1986.", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "163.52.135.6": [ "virustotal", "otx" ], "216.9.225.228": [ "otx" ], "45.115.26.21": [ "pulsedive", "otx", "dshield" ], "51.83.251.173": [ "otx", "dshield" ], "91.239.211.65": [ "otx", "shodan" ], "23.234.109.56": [ "otx", "dshield" ], "38.253.224.40": [ "otx" ], "20.56.154.181": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "187.33.154.57": [ "ipinfo", "abuseipdb", "otx", "shodan" ] }, "sample_ips": [ { "ip": "45.115.26.21", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 87.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "38.253.224.42", "country": "ID", "asn": 139952, "org": "TRIDATA-AS-ID - PT Trisari Data Indonusa, ID", "threat_score": 85.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "163.52.135.6", "country": "ID", "asn": 154896, "org": "IDNIC-GRIYACLOUD-ID - CV Griya Cloud Server, ID", "threat_score": 67.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "38.253.224.40", "country": "ID", "asn": 139952, "org": "TRIDATA-AS-ID - PT Trisari Data Indonusa, ID", "threat_score": 64.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "91.239.211.65", "country": "DE", "asn": 57043, "org": "HOSTKEY-AS - HOSTKEY B.V., NL", "threat_score": 36.8, "abuse_score": 82, "is_tor": false, "greynoise": null }, { "ip": "51.83.251.173", "country": "PL", "asn": 16276, "org": "OVH - OVH SAS, FR", "threat_score": 30.0, "abuse_score": 60, "is_tor": false, "greynoise": null }, { "ip": "216.9.225.228", "country": "US", "asn": 44382, "org": "WHITELABEL, US", "threat_score": 29.8, "abuse_score": 57, "is_tor": false, "greynoise": null }, { "ip": "208.113.211.86", "country": "US", "asn": 26347, "org": "DREAMHOST-AS - New Dream Network, LLC, US", "threat_score": 25.6, "abuse_score": 54, "is_tor": false, "greynoise": null }, { "ip": "20.56.154.181", "country": "NL", "asn": 8075, "org": "Microsoft Corporation", "threat_score": 21.4, "abuse_score": 36, "is_tor": false, "greynoise": null }, { "ip": "23.234.109.56", "country": "US", "asn": 11878, "org": "TZULO - tzulo, inc., US", "threat_score": 14.4, "abuse_score": 26, "is_tor": false, "greynoise": null }, { "ip": "187.33.154.57", "country": "ES", "asn": 49635, "org": "CLOUDING - CLOUDI NEXTGEN SL, ES", "threat_score": 14.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_4c6bc5bc5953", "hassh": "4c6bc5bc5953c531bde125c3af0ecc84", "tool": { "name": "libssh2_scanner", "classification": "scanner" }, "ip_count": 11, "avg_threat_score": 7.9, "countries": { "NL": 2, "US": 3, "UA": 1, "DE": 1, "PL": 1, "HK": 1, "SK": 1, "BE": 1 }, "top_asns": { "AS62651": 4, "AS62240": 3, "AS22781": 1, "AS6876": 1, "AS212238": 1, "AS140952": 1 }, "organizations": [ "NETPR-BRU-DP", "STL-STL-WSG", "NETPR-WAW-GD", "Strong Technology LLC administrator", "Netprotect", "AS6876-MNT", "Strong Technology IP Admin", "NETPROTECT-MNT", "NETPROTECT-PAR-DP" ], "shared_credentials": [ { "username": "root", "password": "root", "ip_count": 11 } ], "shared_commands": [ { "cmd": "HISTZISE=10000; HISTFILE=~/.bash_history; HISTTIMEFORMAT=' d2ae636d-7d32-4072-a7aa-3a885d8bdd32 '; h", "ips": 11 } ], "deep_enrichment_coverage": { "176.67.80.217": [ "ipinfo", "abuseipdb" ] }, "sample_ips": [ { "ip": "176.67.80.217", "country": "NL", "asn": 62240, "org": "Clouvider - Clouvider Limited, GB", "threat_score": 48.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "216.131.120.66", "country": "US", "asn": 22781, "org": "STRTEC - Strong Technology, LLC., US", "threat_score": 9.2, "abuse_score": 18, "is_tor": false, "greynoise": null }, { "ip": "176.67.80.8", "country": "NL", "asn": 62240, "org": "Clouvider - Clouvider Limited, GB", "threat_score": 8.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "185.228.105.149", "country": "UA", "asn": 6876, "org": "TENET-AS - TENET Scientific Production Enterprise LLC, UA", "threat_score": 8.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "216.131.111.78", "country": "DE", "asn": 212238, "org": "CDNEXT - Datacamp Limited, GB", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "216.151.183.19", "country": "PL", "asn": 140952, "org": "STL-AS-AP - Strong Technology, LLC, US", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "36.255.204.165", "country": "HK", "asn": 62651, "org": "NETPROTECT-DP - Strong Technology, LLC., US", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "64.145.94.92", "country": "US", "asn": 62651, "org": "NETPROTECT-DP - Strong Technology, LLC., US", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "176.67.80.31", "country": "US", "asn": 62240, "org": "Clouvider - Clouvider Limited, GB", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "176.67.87.50", "country": "SK", "asn": 62651, "org": "NETPROTECT-DP - Strong Technology, LLC., US", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "216.131.105.94", "country": "BE", "asn": 62651, "org": "NETPROTECT-DP - Strong Technology, LLC., US", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_748f8c627d3f", "hassh": "748f8c627d3f8ff9921d02f86f55ba2c", "tool": { "name": "Renci.SshNet.SshClient.0.0.1", "classification": "unknown" }, "ip_count": 10, "avg_threat_score": 33.3, "countries": { "CZ": 1, "GE": 1, "TW": 1, "BG": 1, "ID": 2, "DE": 2, "NL": 1, "NP": 1 }, "top_asns": { "AS212238": 2, "AS201533": 1, "AS49129": 1, "AS3462": 1, "AS39251": 1, "AS7713": 1, "AS9009": 1, "AS17501": 1, "AS4787": 1 }, "organizations": [ "HINET Network-Adm", "RIPE Network Coordination Centre", "UNITEDNETWORKS-MNT", "LTD CGC Co", "VPN Consumer Frankfurt, Germany", "IRT-ENTERPRISE-1_NP", "Micron Hosting", "Febrian Setiadi", "IRT-CBN-ID", "NETGUARD Ltd." ], "shared_credentials": [ { "username": "root", "password": "root", "ip_count": 10 } ], "shared_commands": [ { "cmd": "> a6s87d6as8zdgtdyas.ini", "ips": 3 }, { "cmd": "apt-get update -y", "ips": 3 }, { "cmd": "sudo apt-get update -y", "ips": 3 } ], "deep_enrichment_coverage": { "158.173.156.36": [ "otx", "dshield", "shodan" ], "185.179.67.142": [ "otx", "shodan" ], "91.92.82.135": [ "otx", "dshield", "shodan" ], "185.71.233.73": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "114.35.55.111": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "shodan" ], "36.64.131.10": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "dshield", "shodan" ], "80.77.53.41": [ "ipinfo", "abuseipdb", "shodan" ] }, "sample_ips": [ { "ip": "185.71.233.73", "country": "CZ", "asn": 201533, "org": "UNITED_NETWORKS_SE - United Networks SE, CZ", "threat_score": 73.6, "abuse_score": 89, "is_tor": false, "greynoise": null }, { "ip": "80.77.53.41", "country": "GE", "asn": 49129, "org": "CGC-AS - LTD CGC Co, GE", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "114.35.55.111", "country": "TW", "asn": 3462, "org": "HINET - Data Communication Business Group, TW", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "91.92.82.135", "country": "BG", "asn": 39251, "org": "NETGUARD - NETGUARD LLC, BG", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "36.64.131.10", "country": "ID", "asn": 7713, "org": "telkomnet-as-ap - PT Telekomunikasi Indonesia, ID", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.179.67.142", "country": "DE", "asn": 9009, "org": "M247 - M247 Europe SRL, RO", "threat_score": 16.8, "abuse_score": 2, "is_tor": false, "greynoise": null }, { "ip": "158.173.156.36", "country": "DE", "asn": 212238, "org": "CDNEXT - Datacamp Limited, GB", "threat_score": 12.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "158.173.154.114", "country": "NL", "asn": 212238, "org": "RIPE Network Coordination Centre", "threat_score": 6.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "202.166.207.233", "country": "NP", "asn": 17501, "org": "WLINK-NEPAL-AS-AP - WorldLink Communications Pvt Ltd, NP", "threat_score": 4.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "103.113.134.154", "country": "ID", "asn": 4787, "org": "ASN-CBN - PT Cyberindo Aditama, ID", "threat_score": 4.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_87e3d9ffee05", "hassh": "87e3d9ffee0540b0390f8a5b9c343c08", "tool": { "name": "paramiko_script", "classification": "script" }, "ip_count": 10, "avg_threat_score": 37.2, "countries": { "US": 9, "DE": 1 }, "top_asns": { "AS16509": 8, "AS8560": 1, "AS215590": 1 }, "organizations": [ "Amazon Technologies Inc.", "IONOS SE", "Amazon.com, Inc." ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "35.95.104.87": [ "virustotal", "otx" ], "35.95.103.254": [ "virustotal", "otx" ], "54.176.8.54": [ "shodan" ], "54.200.58.153": [ "otx", "shodan" ], "54.151.0.202": [ "otx" ], "100.23.213.128": [ "otx" ], "3.101.153.151": [ "otx", "dshield" ], "13.57.228.30": [ "otx", "dshield" ], "217.154.182.55": [ "dshield" ] }, "sample_ips": [ { "ip": "35.95.103.254", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "54.200.58.153", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "35.95.104.87", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "100.23.213.128", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "54.176.8.54", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 48.4, "abuse_score": 81, "is_tor": false, "greynoise": null }, { "ip": "3.101.153.151", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 38.4, "abuse_score": 56, "is_tor": false, "greynoise": null }, { "ip": "54.151.0.202", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 31.6, "abuse_score": 39, "is_tor": false, "greynoise": null }, { "ip": "13.57.228.30", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 16.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "217.154.182.55", "country": "DE", "asn": 8560, "org": "IONOS SE", "threat_score": 12.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "150.241.116.234", "country": "US", "asn": 215590, "org": "XORA-AS - DpkgSoft International Limited, GB", "threat_score": 0.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_2f5ebb184f5d", "hassh": "2f5ebb184f5d02324eed9a822f5259dc", "tool": { "name": "makiko", "classification": "unknown" }, "ip_count": 9, "avg_threat_score": 24.8, "countries": { "HK": 2, "CN": 4, "US": 2, "SG": 1 }, "top_asns": { "AS45102": 3, "AS4837": 2, "AS6134": 1, "AS137718": 1, "AS37963": 1, "AS5650": 1 }, "organizations": [ "Alibaba NOC", "Frontier Communications Corporation", "Alibaba Cloud (Singapore) Private Limited", "IRT-CU-CN", "Alibaba Cloud LLC", "security trouble", "Lan Li", "IRT-VOLCANO-ENGINE-CN", "XNNET LLC" ], "shared_credentials": [ { "username": "root", "password": "123456", "ip_count": 9 } ], "shared_commands": [ { "cmd": ">yoA@/;'8ELFP;i2", "ips": 2 }, { "cmd": "cat /bin/echoQtd#UPX!", "ips": 2 } ], "deep_enrichment_coverage": { "47.180.61.210": [ "otx" ], "38.147.177.174": [ "pulsedive", "virustotal", "otx", "shodan" ], "47.83.203.183": [ "pulsedive", "otx", "urlhaus" ], "115.190.212.78": [ "otx" ], "221.6.123.203": [ "otx" ], "47.100.241.172": [ "greynoise", "otx" ], "43.99.20.50": [ "otx" ], "47.237.124.1": [ "dshield" ] }, "sample_ips": [ { "ip": "38.147.177.174", "country": "HK", "asn": 6134, "org": "XNNET - XNNET LLC, US", "threat_score": 54.6, "abuse_score": 94, "is_tor": false, "greynoise": null }, { "ip": "47.83.203.183", "country": "HK", "asn": 45102, "org": "ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "221.6.123.203", "country": "CN", "asn": 4837, "org": "CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN", "threat_score": 31.6, "abuse_score": 69, "is_tor": false, "greynoise": null }, { "ip": "115.190.212.78", "country": "CN", "asn": 137718, "org": "VOLCANO-ENGINE - Beijing Volcano Engine Technology Co., Ltd., CN", "threat_score": 21.6, "abuse_score": 39, "is_tor": false, "greynoise": null }, { "ip": "47.100.241.172", "country": "CN", "asn": 37963, "org": "ALIBABA-CN-NET - Hangzhou Alibaba Advertising Co.,Ltd., CN", "threat_score": 20.8, "abuse_score": 42, "is_tor": false, "greynoise": null }, { "ip": "47.237.124.1", "country": "US", "asn": 45102, "org": "ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN", "threat_score": 16.8, "abuse_score": 32, "is_tor": false, "greynoise": null }, { "ip": "47.180.61.210", "country": "US", "asn": 5650, "org": "FRONTIER-FRTR - Frontier Communications of America, Inc., US", "threat_score": 14.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "43.99.20.50", "country": "SG", "asn": 45102, "org": "ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd., CN", "threat_score": 12.0, "abuse_score": 25, "is_tor": false, "greynoise": null }, { "ip": "60.212.101.158", "country": "CN", "asn": 4837, "org": "CHINA169-Backbone - CHINA UNICOM China169 Backbone, CN", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_bf7dbf67fa9b", "hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tool": null, "ip_count": 8, "avg_threat_score": 31.2, "countries": { "NL": 2, "IT": 1, "US": 1, "RU": 2, "PK": 1, "PT": 1 }, "top_asns": { "AS48090": 2, "AS30722": 1, "AS22773": 1, "AS50916": 1, "AS17557": 1, "AS12389": 1, "AS12353": 1 }, "organizations": [ "TECHOFF SRV LIMITED", "Pakistan Telecommuication company limited", "Yan Telecom Ltd", "Vodafone Italy", "Vodafone Portugal IP Management", "Cox Communications Inc.", "ru.spbnit contact role" ], "shared_credentials": [ { "username": "AdminGPON", "password": "ALC#FGU", "ip_count": 3 }, { "username": "root", "password": "admin", "ip_count": 3 }, { "username": "support", "password": "support", "ip_count": 3 }, { "username": "admin", "password": "admin", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "195.178.110.137": [ "active_recon", "virustotal", "otx", "dshield" ], "184.186.73.82": [ "otx", "shodan" ], "93.150.55.82": [ "otx", "shodan" ], "45.148.10.121": [ "otx", "dshield", "shodan" ] }, "sample_ips": [ { "ip": "195.178.110.137", "country": "NL", "asn": 48090, "org": "DMZHOST - TECHOFF SRV LIMITED, GB", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "malicious" }, { "ip": "45.148.10.121", "country": "NL", "asn": 48090, "org": "DMZHOST - TECHOFF SRV LIMITED, GB", "threat_score": 97.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "93.150.55.82", "country": "IT", "asn": 30722, "org": "VODAFONE-IT-ASN - Fastweb SpA, IT", "threat_score": 24.8, "abuse_score": 27, "is_tor": false, "greynoise": null }, { "ip": "184.186.73.82", "country": "US", "asn": 22773, "org": "ASN-CXA-ALL-CCI-22773-RDC - Cox Communications Inc., US", "threat_score": 12.0, "abuse_score": 15, "is_tor": false, "greynoise": null }, { "ip": "93.170.127.227", "country": "RU", "asn": 50916, "org": "NADYMSS-AS - Yan Telecom Ltd, RU", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "39.35.138.247", "country": "PK", "asn": 17557, "org": "PKTELECOM-AS-PK - Pakistan Telecommunication Company Limited, PK", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "92.101.222.187", "country": "RU", "asn": 12389, "org": "ROSTELECOM-AS - PJSC Rostelecom, RU", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "178.166.99.40", "country": "PT", "asn": 12353, "org": "VODAFONE-PT - Vodafone Portugal - Communicacoes Pessoais S.A., PT", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_a984ff804585", "hassh": "a984ff804585fabe3cd08f4b3849024a", "tool": { "name": "OpenSSH-keyscan", "classification": "unknown" }, "ip_count": 7, "avg_threat_score": 48.4, "countries": { "FR": 1, "US": 5, "DE": 1 }, "top_asns": { "AS14061": 4, "AS63949": 2, "AS12876": 1 }, "organizations": [ "Linode", "Scaleway", "DigitalOcean, LLC" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "45.79.143.101": [ "otx" ], "157.230.208.239": [ "virustotal", "shodan" ], "64.225.96.217": [ "pulsedive", "otx", "shodan" ], "97.107.132.130": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "51.158.205.203": [ "ipinfo", "abuseipdb", "otx", "shodan" ], "64.227.51.132": [ "active_recon" ] }, "sample_ips": [ { "ip": "51.158.205.203", "country": "FR", "asn": 12876, "org": "AS12876 - Scaleway SAS, FR", "threat_score": 86.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "157.230.208.239", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 67.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.79.143.101", "country": "US", "asn": 63949, "org": "AKAMAI-LINODE-AP - Akamai Connected Cloud, SG", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": "benign" }, { "ip": "97.107.132.130", "country": "US", "asn": 63949, "org": "AKAMAI-LINODE-AP - Akamai Connected Cloud, SG", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "167.172.130.235", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 42.8, "abuse_score": 52, "is_tor": false, "greynoise": null }, { "ip": "64.225.96.217", "country": "DE", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 28.8, "abuse_score": 42, "is_tor": false, "greynoise": null }, { "ip": "64.227.51.132", "country": "US", "asn": 14061, "org": "DigitalOcean, LLC", "threat_score": 12.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_c70169683f41", "hassh": "c70169683f416ecb6afc5aed972ec23c", "tool": null, "ip_count": 7, "avg_threat_score": 60.8, "countries": { "SE": 1, "DE": 6 }, "top_asns": { "AS403005": 3, "AS401626": 3, "AS20473": 1 }, "organizations": [ "IRT-GZSYSTEMS-HK", "The Constant Company, LLC", "Netiface America, Inc." ], "shared_credentials": [ { "username": "root", "password": "root", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "64.89.163.175": [ "otx", "shodan" ], "23.132.164.164": [ "otx", "shodan" ], "43.228.157.231": [ "otx", "shodan" ], "23.132.164.148": [ "otx" ], "43.228.157.207": [ "virustotal", "otx", "shodan" ], "70.34.202.108": [ "otx", "shodan" ], "43.228.157.232": [ "otx" ] }, "sample_ips": [ { "ip": "70.34.202.108", "country": "SE", "asn": 20473, "org": "AS-VULTR - The Constant Company, LLC, US", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "43.228.157.207", "country": "DE", "asn": 403005, "org": "BLATANTHOST - Blatant, SC", "threat_score": 73.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "43.228.157.231", "country": "DE", "asn": 403005, "org": "BLATANTHOST - Blatant, SC", "threat_score": 58.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "23.132.164.148", "country": "DE", "asn": 401626, "org": "NETIFACE-TORONTO - Netiface America, Inc., US", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "23.132.164.164", "country": "DE", "asn": 401626, "org": "NETIFACE-TORONTO - Netiface America, Inc., US", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.89.163.175", "country": "DE", "asn": 401626, "org": "NETIFACE-TORONTO - Netiface America, Inc., US", "threat_score": 49.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "43.228.157.232", "country": "DE", "asn": 403005, "org": "BLATANTHOST - Blatant, SC", "threat_score": 45.6, "abuse_score": 89, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_eff4c24daffc", "hassh": "eff4c24daffc8532c160e86e5f006e53", "tool": { "name": "go_scanner", "classification": "scanner" }, "ip_count": 7, "avg_threat_score": 55.4, "countries": { "PL": 4, "BG": 1, "RU": 1, "AE": 1 }, "top_asns": { "AS212835": 2, "AS154383": 1, "AS209702": 1, "AS200730": 1, "AS198953": 1, "AS216071": 1 }, "organizations": [ "servers-tech-mnt", "BearShield Technologies S.R.O.", "SOLDATOV ALEXEY VALEREVICH", "Proton66 OOO", "ru-avm-1-mnt", "Isaev Igor" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 7 } ], "shared_commands": [], "deep_enrichment_coverage": { "176.53.159.196": [ "active_recon", "otx", "dshield" ], "87.251.64.176": [ "active_recon", "pulsedive", "virustotal", "ipinfo", "abuseipdb", "otx", "dshield", "shodan" ], "37.77.150.119": [ "ipinfo", "abuseipdb" ], "87.251.64.150": [ "abuseipdb", "shodan" ], "87.251.64.146": [ "pulsedive", "abuseipdb", "otx", "shodan" ], "80.66.66.10": [ "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "176.53.159.196", "country": "PL", "asn": 154383, "org": "ZWS-AS-AP - ZORNTECH WEB SOLUTIONS, BD", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "malicious" }, { "ip": "87.251.64.176", "country": "PL", "asn": 212835, "org": "SHESTERNIN-AS - Shesternin Vladimir Anatolievich, KZ", "threat_score": 80.0, "abuse_score": 0, "is_tor": false, "greynoise": "malicious" }, { "ip": "80.66.66.10", "country": "BG", "asn": 209702, "org": "SOLDATOV-AS - SOLDATOV ALEXEY VALEREVICH, KZ", "threat_score": 58.6, "abuse_score": 9, "is_tor": false, "greynoise": null }, { "ip": "87.251.64.146", "country": "PL", "asn": 200730, "org": "ISAEV - ISAEV Igor, KZ", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "87.251.64.150", "country": "PL", "asn": 212835, "org": "SHESTERNIN-AS - Shesternin Vladimir Anatolievich, KZ", "threat_score": 50.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "37.77.150.119", "country": "RU", "asn": 198953, "org": "proton66 - Proton66 OOO, RU", "threat_score": 46.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "89.124.97.231", "country": "AE", "asn": 216071, "org": "VDSINA - SERVERS TECH FZCO, AE", "threat_score": 2.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_46a2ae5b447a", "hassh": "46a2ae5b447a73d9fbe6516e4b25976e", "tool": null, "ip_count": 7, "avg_threat_score": 12.0, "countries": { "KR": 2, "BR": 1, "AU": 1, "PK": 1, "TH": 1, "VE": 1 }, "top_asns": { "AS3786": 1, "AS271751": 1, "AS4766": 1, "AS7545": 1, "AS17557": 1, "AS131090": 1, "AS8048": 1 }, "organizations": [ "Pakistan Telecommuication company limited", "GIGANET WIRELESS LTDA", "IRT-KRNIC-KR", "IRT-NTPCL-TH", "TPG Internet Pty Ltd", "CANTV Servicios, Venezuela" ], "shared_credentials": [ { "username": "root", "password": "admin", "ip_count": 3 }, { "username": "support", "password": "support", "ip_count": 3 } ], "shared_commands": [], "deep_enrichment_coverage": { "45.164.40.48": [ "otx", "shodan" ], "58.149.235.226": [ "pulsedive", "otx" ] }, "sample_ips": [ { "ip": "58.149.235.226", "country": "KR", "asn": 3786, "org": "LGDACOM-KR - LG DACOM Corporation, KR", "threat_score": 38.0, "abuse_score": 80, "is_tor": false, "greynoise": null }, { "ip": "45.164.40.48", "country": "BR", "asn": 271751, "org": "AS271751 - GIGANET WIRELESS LTDA, BR", "threat_score": 19.2, "abuse_score": 13, "is_tor": false, "greynoise": null }, { "ip": "220.92.57.240", "country": "KR", "asn": 4766, "org": "KIXS-AS-KR-KR - Korea Telecom, KR", "threat_score": 8.8, "abuse_score": 12, "is_tor": false, "greynoise": null }, { "ip": "27.32.45.226", "country": "AU", "asn": 7545, "org": "TPG-INTERNET-AP - TPG Telecom Limited, AU", "threat_score": 6.0, "abuse_score": 5, "is_tor": false, "greynoise": null }, { "ip": "39.36.41.12", "country": "PK", "asn": 17557, "org": "PKTELECOM-AS-PK - Pakistan Telecommunication Company Limited, PK", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "110.78.133.63", "country": "TH", "asn": 131090, "org": "NTPCL-AS-AP - National Telecom Public Company Limited, TH", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "190.77.128.93", "country": "VE", "asn": 8048, "org": "AS8048 - CANTV Servicios, Venezuela, VE", "threat_score": 4.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_44ac1859818d", "hassh": "44ac1859818d6cacfb48ec9cb230b3f0", "tool": { "name": "libssh2_scanner", "classification": "scanner" }, "ip_count": 7, "avg_threat_score": 47.1, "countries": { "GP": 1, "DE": 1, "US": 1, "GB": 2, "KZ": 1, "TW": 1 }, "top_asns": { "AS14061": 2, "AS21351": 1, "AS20473": 1, "AS29046": 1, "AS4780": 1 }, "organizations": [ "Vultr Holdings, LLC", "DigitalOcean, LLC", "RBKKZ-MNT", "Private Customer", "CPLUSTELECOM-ADMIN-MNT", "Anti-Spammer NCIC" ], "shared_credentials": [ { "username": "root", "password": "root", "ip_count": 6 } ], "shared_commands": [ { "cmd": "/ip cloud print", "ips": 6 }, { "cmd": "cat /proc/cpuinfo", "ips": 6 }, { "cmd": "echo Hi | cat -n", "ips": 6 }, { "cmd": "locate D877F783D5D3EF8Cs", "ips": 6 }, { "cmd": "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* ", "ips": 6 }, { "cmd": "ps -ef | grep '[Mm]iner'", "ips": 6 }, { "cmd": "ps | grep '[Mm]iner'", "ips": 6 } ], "deep_enrichment_coverage": { "136.244.71.137": [ "dshield" ], "191.101.59.133": [ "otx", "dshield", "shodan" ], "164.92.109.155": [ "virustotal", "otx" ], "64.226.126.224": [ "otx", "shodan" ], "81.18.37.142": [ "ipinfo", "abuseipdb" ], "5.187.97.40": [ "ipinfo", "abuseipdb", "dshield" ] }, "sample_ips": [ { "ip": "5.187.97.40", "country": "GP", "asn": 21351, "org": "CANALPLUSTELECOM - Canal + Telecom SAS, GP", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "64.226.126.224", "country": "DE", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "164.92.109.155", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "191.101.59.133", "country": "GB", "asn": null, "org": null, "threat_score": 45.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "136.244.71.137", "country": "GB", "asn": 20473, "org": "AS-VULTR - The Constant Company, LLC, US", "threat_score": 44.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "81.18.37.142", "country": "KZ", "asn": 29046, "org": "RBK-AS - Radiobaylanys LLP, KZ", "threat_score": 30.0, "abuse_score": 70, "is_tor": false, "greynoise": null }, { "ip": "210.66.181.34", "country": "TW", "asn": 4780, "org": "SEEDNET - Digital United Inc., TW", "threat_score": 0.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_a2de0f306611", "hassh": "a2de0f306611e0957be704f5b0e35a82", "tool": { "name": "paramiko_script", "classification": "script" }, "ip_count": 6, "avg_threat_score": 52.0, "countries": { "PL": 2, "NL": 2, "UA": 1, "KH": 1 }, "top_asns": { "AS201814": 2, "AS215125": 1, "AS200019": 1, "AS214961": 1, "AS17976": 1 }, "organizations": [ "WEBNETWORK-MNT", "SKYTECH-MNT", "CAMGSM Company Ltd", "SN-LIR-MNT", "Mevspace Admins", "CLOUDATAMD-MNT" ], "shared_credentials": [ { "username": "root", "password": "Google1986.", "ip_count": 3 } ], "shared_commands": [], "deep_enrichment_coverage": { "195.3.220.88": [ "ipinfo", "abuseipdb", "otx", "shodan" ], "192.42.116.43": [ "abuseipdb", "otx", "shodan" ], "132.243.166.58": [ "pulsedive", "ipinfo", "abuseipdb" ], "94.154.32.94": [ "ipinfo", "otx", "shodan" ], "195.3.220.7": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "shodan" ] }, "sample_ips": [ { "ip": "195.3.220.7", "country": "PL", "asn": 201814, "org": "Mevspace - MEVSPACE sp. z o.o., PL", "threat_score": 98.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "192.42.116.43", "country": "NL", "asn": 215125, "org": "CYBEROLOGY-AS, NL", "threat_score": 80.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "195.3.220.88", "country": "PL", "asn": 201814, "org": "Mevspace - MEVSPACE sp. z o.o., PL", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "132.243.166.58", "country": "NL", "asn": 200019, "org": "AlexHost - ALEXHOST SRL, MD", "threat_score": 44.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.154.32.94", "country": "UA", "asn": 214961, "org": "STELLARGROUPSAS - Stellar Group SAS, FR", "threat_score": 43.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "203.144.76.188", "country": "KH", "asn": 17976, "org": "CamGSM-CELLCARD-AS-AP - CAMGSM Company Ltd, KH", "threat_score": 1.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_0df0d56bb50c", "hassh": "0df0d56bb50c6b2426d8d40234bf1826", "tool": { "name": "openssh_legacy", "classification": "legacy" }, "ip_count": 6, "avg_threat_score": 40.7, "countries": { "SE": 1, "US": 2, "NL": 3 }, "top_asns": { "AS33915": 2, "AS8434": 1, "AS4922": 1, "AS11595": 1, "AS35467": 1 }, "organizations": [ "Shenandoah Cable Television LLC", "Netsonic", "TNSE-MNT", "VODAFONEZIGGO IP AUTHORITY", "DDFR NOC", "MNT-LGI" ], "shared_credentials": [ { "username": "ubuntu", "password": "goITn0w89", "ip_count": 6 }, { "username": "ubuntu", "password": "ubuntu", "ip_count": 6 } ], "shared_commands": [ { "cmd": "echo \"ERROR: BADtype: export\"", "ips": 6 }, { "cmd": "export HISTFILE=/dev/null", "ips": 6 }, { "cmd": "export HISTSAVE=/dev/null", "ips": 6 }, { "cmd": "if ! type export >/dev/null 2>&1; then", "ips": 6 } ], "deep_enrichment_coverage": { "217.27.225.43": [ "otx", "dshield", "shodan" ], "216.235.75.158": [ "otx", "dshield", "shodan" ], "95.97.24.66": [ "otx", "shodan" ], "204.111.121.226": [ "ipinfo", "otx", "dshield", "shodan" ], "85.227.86.238": [ "ipinfo", "abuseipdb", "otx", "dshield" ] }, "sample_ips": [ { "ip": "85.227.86.238", "country": "SE", "asn": 8434, "org": "TELENOR-SE - Telenor Sverige AB, SE", "threat_score": 69.8, "abuse_score": 37, "is_tor": false, "greynoise": null }, { "ip": "204.111.121.226", "country": "US", "asn": 4922, "org": "SHENTEL - Shenandoah Cable Television LLC, US", "threat_score": 51.2, "abuse_score": 43, "is_tor": false, "greynoise": null }, { "ip": "95.97.24.66", "country": "NL", "asn": 33915, "org": "TNF-AS - Vodafone Libertel B.V., NL", "threat_score": 40.0, "abuse_score": 40, "is_tor": false, "greynoise": null }, { "ip": "216.235.75.158", "country": "US", "asn": 11595, "org": "NETSONIC - Netsonic, US", "threat_score": 36.8, "abuse_score": 2, "is_tor": false, "greynoise": null }, { "ip": "94.214.102.15", "country": "NL", "asn": 33915, "org": "TNF-AS - Vodafone Libertel B.V., NL", "threat_score": 28.4, "abuse_score": 26, "is_tor": false, "greynoise": null }, { "ip": "217.27.225.43", "country": "NL", "asn": 35467, "org": "DDF-AS - DDFR IT Infra & Security B.V., NL", "threat_score": 18.0, "abuse_score": 0, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_2a86d5946159", "hassh": "2a86d5946159539cb26c1657f9c447f2", "tool": { "name": "sshcustom_0.1", "classification": "unknown" }, "ip_count": 6, "avg_threat_score": 88.1, "countries": { "PL": 6 }, "top_asns": { "AS200730": 2, "AS212835": 2, "AS154383": 2 }, "organizations": [ "ru-avm-1-mnt", "tr-hopes-1-mnt", "Isaev Igor" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 6 }, { "username": "support", "password": "support", "ip_count": 6 }, { "username": "support", "password": "qwerty", "ip_count": 6 }, { "username": "support", "password": "123456", "ip_count": 6 }, { "username": "support", "password": "password", "ip_count": 6 }, { "username": "support", "password": "123456789", "ip_count": 6 }, { "username": "support", "password": "iloveyou", "ip_count": 4 }, { "username": "support", "password": "password1", "ip_count": 4 }, { "username": "support", "password": "123123", "ip_count": 4 }, { "username": "support", "password": "111111", "ip_count": 4 }, { "username": "support", "password": "1234", "ip_count": 4 }, { "username": "support", "password": "1234567890", "ip_count": 4 }, { "username": "support", "password": "1q2w3e4r5t", "ip_count": 4 }, { "username": "support", "password": "12345678", "ip_count": 4 }, { "username": "support", "password": "monkey", "ip_count": 4 }, { "username": "support", "password": "123", "ip_count": 4 }, { "username": "support", "password": "qwertyuiop", "ip_count": 4 }, { "username": "support", "password": "000000", "ip_count": 4 }, { "username": "support", "password": "abc123", "ip_count": 4 }, { "username": "support", "password": "12345", "ip_count": 4 }, { "username": "support", "password": "1234567", "ip_count": 4 }, { "username": "support", "password": "121212", "ip_count": 2 }, { "username": "support", "password": "112233", "ip_count": 2 }, { "username": "support", "password": "102030", "ip_count": 2 }, { "username": "support", "password": "123456789a", "ip_count": 2 }, { "username": "support", "password": "1111111111", "ip_count": 2 }, { "username": "support", "password": "123456a", "ip_count": 2 }, { "username": "support", "password": "123456q", "ip_count": 2 }, { "username": "support", "password": "12345a", "ip_count": 2 }, { "username": "support", "password": "1234qwer", "ip_count": 2 }, { "username": "support", "password": "654321", "ip_count": 2 }, { "username": "support", "password": "555555", "ip_count": 2 }, { "username": "support", "password": "5201314", "ip_count": 2 }, { "username": "support", "password": "11111111", "ip_count": 2 }, { "username": "support", "password": "101010", "ip_count": 2 }, { "username": "support", "password": "222222", "ip_count": 2 }, { "username": "support", "password": "1qaz2wsx", "ip_count": 2 }, { "username": "support", "password": "1111111", "ip_count": 2 }, { "username": "support", "password": "1q2w3e4r", "ip_count": 2 }, { "username": "support", "password": "1q2w3e", "ip_count": 2 }, { "username": "support", "password": "1g2w3e4r", "ip_count": 2 }, { "username": "support", "password": "159753", "ip_count": 2 }, { "username": "support", "password": "0987654321", "ip_count": 2 }, { "username": "support", "password": "159357", "ip_count": 2 }, { "username": "support", "password": "147258369", "ip_count": 2 }, { "username": "support", "password": "333333", "ip_count": 2 }, { "username": "support", "password": "123321", "ip_count": 2 }, { "username": "support", "password": "147258", "ip_count": 2 }, { "username": "support", "password": "131313", "ip_count": 2 }, { "username": "support", "password": "123123123", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "176.53.159.198": [ "otx", "dshield" ], "176.53.159.197": [ "dshield" ], "87.251.64.144": [ "active_recon", "pulsedive", "ipinfo", "abuseipdb", "otx", "shodan" ], "87.251.64.145": [ "active_recon", "ipinfo", "abuseipdb", "otx", "dshield" ], "87.251.64.149": [ "abuseipdb", "shodan" ], "87.251.64.147": [ "abuseipdb", "shodan" ] }, "sample_ips": [ { "ip": "87.251.64.147", "country": "PL", "asn": 200730, "org": "ISAEV - ISAEV Igor, KZ", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "87.251.64.149", "country": "PL", "asn": 200730, "org": "ISAEV - ISAEV Igor, KZ", "threat_score": 93.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "87.251.64.144", "country": "PL", "asn": 212835, "org": "SHESTERNIN-AS - Shesternin Vladimir Anatolievich, KZ", "threat_score": 87.2, "abuse_score": 28, "is_tor": false, "greynoise": "malicious" }, { "ip": "87.251.64.145", "country": "PL", "asn": 212835, "org": "SHESTERNIN-AS - Shesternin Vladimir Anatolievich, KZ", "threat_score": 86.8, "abuse_score": 27, "is_tor": false, "greynoise": "malicious" }, { "ip": "176.53.159.197", "country": "PL", "asn": 154383, "org": "ZWS-AS-AP - ZORNTECH WEB SOLUTIONS, BD", "threat_score": 84.4, "abuse_score": 91, "is_tor": false, "greynoise": null }, { "ip": "176.53.159.198", "country": "PL", "asn": 154383, "org": "ZWS-AS-AP - ZORNTECH WEB SOLUTIONS, BD", "threat_score": 84.0, "abuse_score": 90, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_5445c358120b", "hassh": "5445c358120b523b688fb5f70acd1122", "tool": { "name": "OpenSSH_6.6.1", "classification": "unknown" }, "ip_count": 6, "avg_threat_score": 43.7, "countries": { "US": 6 }, "top_asns": { "AS10439": 6 }, "organizations": [ "CariNet, Inc." ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "71.6.232.24": [ "active_recon" ], "71.6.232.27": [ "otx", "dshield" ], "71.6.232.23": [ "dshield" ], "71.6.232.20": [ "pulsedive", "otx" ], "71.6.232.29": [ "dshield" ], "71.6.232.28": [ "ipinfo", "abuseipdb", "dshield" ] }, "sample_ips": [ { "ip": "71.6.232.20", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.232.28", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.232.24", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.232.27", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 50.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "71.6.232.23", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 47.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "71.6.232.29", "country": "US", "asn": 10439, "org": "CARINET - CariNet, Inc., US", "threat_score": 7.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_6a77bbd6ef48", "hassh": "6a77bbd6ef48d6a9959a47aa4a42a505", "tool": { "name": "go_scanner", "classification": "scanner" }, "ip_count": 6, "avg_threat_score": 35.7, "countries": { "NL": 1, "PL": 1, "RU": 4 }, "top_asns": { "AS198953": 3, "AS209702": 1, "AS200730": 1, "AS200593": 1 }, "organizations": [ "RIPE-NCC-END-MNT", "RIPE-NCC-HM-MNT", "ru-avm-1-mnt", "soldatov-av-mnt" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 6 }, { "username": "support", "password": "support", "ip_count": 6 } ], "shared_commands": [], "deep_enrichment_coverage": { "176.120.22.17": [ "otx" ], "176.120.22.47": [ "otx" ], "176.120.22.13": [ "otx" ], "87.251.64.141": [ "abuseipdb", "otx", "dshield" ], "80.66.66.70": [ "ipinfo", "abuseipdb", "otx", "dshield" ], "91.202.233.33": [ "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "80.66.66.70", "country": "NL", "asn": 209702, "org": "SOLDATOV-AS - SOLDATOV ALEXEY VALEREVICH, KZ", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "87.251.64.141", "country": "PL", "asn": 200730, "org": "ISAEV - ISAEV Igor, KZ", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "91.202.233.33", "country": "RU", "asn": 200593, "org": "PROSPERO-AS - PROSPERO OOO, RU", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "176.120.22.13", "country": "RU", "asn": 198953, "org": "proton66 - Proton66 OOO, RU", "threat_score": 19.0, "abuse_score": 25, "is_tor": false, "greynoise": null }, { "ip": "176.120.22.47", "country": "RU", "asn": 198953, "org": "proton66 - Proton66 OOO, RU", "threat_score": 17.4, "abuse_score": 21, "is_tor": false, "greynoise": null }, { "ip": "176.120.22.17", "country": "RU", "asn": 198953, "org": "proton66 - Proton66 OOO, RU", "threat_score": 15.0, "abuse_score": 20, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_88e4f54f9428", "hassh": "88e4f54f942892da498676735732aec7", "tool": null, "ip_count": 6, "avg_threat_score": 66.7, "countries": { "US": 1, "GB": 1, "NL": 2, "DE": 1, "BR": 1 }, "top_asns": { "AS19318": 1, "AS55286": 1, "AS209373": 1, "AS197170": 1, "AS24940": 1, "AS28260": 1 }, "organizations": [ "TechTies Inc.", "Interserver, Inc", "SWISSNET LLC", "Hetzner Online GmbH", "B2 Net Solutions Inc.", "Global Telecom do Brasil" ], "shared_credentials": [ { "username": "dev", "password": "1", "ip_count": 3 } ], "shared_commands": [], "deep_enrichment_coverage": { "187.95.46.100": [ "otx", "dshield", "shodan" ], "94.130.36.242": [ "otx", "dshield", "shodan" ], "209.159.157.69": [ "virustotal", "shodan" ], "31.56.209.211": [ "virustotal", "otx", "urlhaus", "shodan" ], "85.11.167.212": [ "virustotal", "otx", "shodan" ], "23.229.7.254": [ "virustotal", "otx", "dshield", "shodan" ] }, "sample_ips": [ { "ip": "209.159.157.69", "country": "US", "asn": 19318, "org": "IS-AS-1 - Interserver, Inc, US", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "23.229.7.254", "country": "GB", "asn": 55286, "org": "SERVER-MANIA - B2 Net Solutions Inc., CA", "threat_score": 75.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.56.209.211", "country": "NL", "asn": 209373, "org": "SWISSNET-AS - SWISSNET LLC, US", "threat_score": 71.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "85.11.167.212", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "threat_score": 62.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "94.130.36.242", "country": "DE", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 47.2, "abuse_score": 83, "is_tor": false, "greynoise": null }, { "ip": "187.95.46.100", "country": "BR", "asn": 28260, "org": "AS28260 - ALTA REDE CORPORATE NETWORK TELECOM LTDA - EPP, BR", "threat_score": 45.0, "abuse_score": 100, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_eeca2460550b", "hassh": "eeca2460550b9ded084ecf2f70a75356", "tool": { "name": "OpenSSH_10.0p2 Debian-7+deb13u2", "classification": "unknown" }, "ip_count": 6, "avg_threat_score": 45.1, "countries": { "ID": 1, "US": 2, "DE": 2, "NL": 1 }, "top_asns": { "AS132649": 1, "AS397032": 1, "AS213250": 1, "AS24940": 1, "AS215125": 1, "AS14061": 1 }, "organizations": [ "DeinServerHost", "IRT-ADAUNET-ID", "DigitalOcean, LLC", "SN-LIR-MNT", "Hetzner Online GmbH", "SPARKED-MNT" ], "shared_credentials": [ { "username": "pi", "password": "raspberry", "ip_count": 4 }, { "username": "pi", "password": "", "ip_count": 3 } ], "shared_commands": [], "deep_enrichment_coverage": { "192.42.116.17": [ "otx", "dshield", "shodan" ], "159.203.66.5": [ "otx", "dshield" ], "162.55.165.206": [ "otx" ], "103.24.212.42": [ "active_recon", "virustotal", "ipinfo", "abuseipdb", "otx", "dshield", "censys", "shodan" ], "193.31.31.234": [ "ipinfo", "abuseipdb", "otx", "shodan", "active_recon" ], "5.182.204.221": [ "ipinfo", "abuseipdb", "shodan" ] }, "sample_ips": [ { "ip": "103.24.212.42", "country": "ID", "asn": 132649, "org": "ADAUNET-AS-ID - PT Adau Putra Network, ID", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "193.31.31.234", "country": "US", "asn": 397032, "org": "SPARKED - SPARKED HOST LLC, US", "threat_score": 61.0, "abuse_score": 40, "is_tor": false, "greynoise": null }, { "ip": "5.182.204.221", "country": "DE", "asn": 213250, "org": "ITP-SOLUTIONS - Dominic Scholz trading as ITP-Solutions GmbH & Co. KG, DE", "threat_score": 53.4, "abuse_score": 21, "is_tor": false, "greynoise": null }, { "ip": "162.55.165.206", "country": "DE", "asn": 24940, "org": "HETZNER-AS - Hetzner Online GmbH, DE", "threat_score": 22.0, "abuse_score": 0, "is_tor": false, "greynoise": null }, { "ip": "192.42.116.17", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 18.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "159.203.66.5", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 16.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_087ab61de4f8", "hassh": "087ab61de4f8afa9ac8f30c1b7c418eb", "tool": { "name": "go_scanner", "classification": "scanner" }, "ip_count": 7, "avg_threat_score": 38.4, "countries": { "NL": 7 }, "top_asns": { "AS215125": 7 }, "organizations": [ "AS1101-MNT", "SN-LIR-MNT" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 7 }, { "username": "root", "password": "", "ip_count": 5 }, { "username": "root", "password": "root", "ip_count": 5 } ], "shared_commands": [], "deep_enrichment_coverage": { "192.42.116.15": [ "pulsedive", "otx", "dshield", "shodan" ], "192.42.116.114": [ "otx" ], "192.42.116.93": [ "abuseipdb" ], "192.42.116.92": [ "abuseipdb", "otx", "shodan" ], "192.42.116.16": [ "abuseipdb", "otx", "shodan" ], "192.42.116.13": [ "abuseipdb", "otx" ], "192.42.116.67": [ "pulsedive", "ipinfo", "abuseipdb", "otx", "dshield", "shodan" ] }, "sample_ips": [ { "ip": "192.42.116.67", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 71.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.114", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 58.0, "abuse_score": 100, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.93", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 35.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.16", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 31.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.13", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 29.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.92", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 27.0, "abuse_score": null, "is_tor": true, "greynoise": null }, { "ip": "192.42.116.15", "country": "NL", "asn": 215125, "org": "Cyberology-AS - Church of Cyberology, NL", "threat_score": 18.0, "abuse_score": null, "is_tor": true, "greynoise": null } ] }, { "cluster_id": "hassh_aae6b9604f6f", "hassh": "aae6b9604f6f3356543709a376d7f657", "tool": { "name": "openssh_modern", "classification": "modern" }, "ip_count": 6, "avg_threat_score": 64.6, "countries": { "NL": 3, "DE": 2, "US": 1 }, "top_asns": { "AS199457": 2, "AS213790": 1, "AS208137": 1, "AS16509": 1, "AS8881": 1 }, "organizations": [ "Secure Internet LLC (UK)", "Feo Prest SRL", "IRT-INTERNETSRV-HK", "VT-ENGI-MNT", "IP Management" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 5 }, { "username": "root", "password": "", "ip_count": 3 }, { "username": "admin", "password": "", "ip_count": 3 }, { "username": "root", "password": "Google1986.", "ip_count": 2 }, { "username": "root", "password": "Multumesc123", "ip_count": 2 }, { "username": "root", "password": "admin", "ip_count": 2 }, { "username": "root", "password": "googlegoogle1986.", "ip_count": 2 }, { "username": "ubuntu", "password": "Multumesc123", "ip_count": 2 }, { "username": "admin", "password": "Google1986.", "ip_count": 2 }, { "username": "pi", "password": "raspberry", "ip_count": 2 } ], "shared_commands": [ { "cmd": "id -u 2>/dev/null; free -m 2>/dev/null | awk \"NR==2{print \\$2}\"", "ips": 2 } ], "deep_enrichment_coverage": { "45.115.26.25": [ "virustotal", "otx" ], "45.115.26.22": [ "otx", "dshield" ], "172.94.9.74": [ "otx", "threatfox", "shodan" ], "213.209.159.41": [ "otx" ] }, "sample_ips": [ { "ip": "172.94.9.74", "country": "NL", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.25", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 91.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "213.209.159.41", "country": "DE", "asn": 208137, "org": "FPS12 - Feo Prest SRL, RO", "threat_score": 88.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "45.115.26.22", "country": "NL", "asn": 199457, "org": "SolidCore - SolidCore Hosting LTD, VG", "threat_score": 70.2, "abuse_score": 58, "is_tor": false, "greynoise": null }, { "ip": "54.176.104.45", "country": "US", "asn": 16509, "org": "AMAZON-02 - Amazon.com, Inc., US", "threat_score": 28.8, "abuse_score": 7, "is_tor": false, "greynoise": null }, { "ip": "89.245.48.64", "country": "DE", "asn": 8881, "org": "VERSATEL - 1&1 Versatel GmbH, DE", "threat_score": 9.6, "abuse_score": 19, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_8e8294623d29", "hassh": "8e8294623d295b5c79addcd28d64328c", "tool": { "name": "openssh_modern", "classification": "modern" }, "ip_count": 5, "avg_threat_score": 29.0, "countries": { "DE": 1, "GB": 4 }, "top_asns": { "AS25369": 5 }, "organizations": [ "HYDRA-MNT", "Infrawatch Limited" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "69.5.169.4": [ "ipinfo", "abuseipdb", "otx" ], "31.14.254.25": [ "ipinfo", "abuseipdb" ], "5.226.140.25": [ "ipinfo", "abuseipdb" ] }, "sample_ips": [ { "ip": "69.5.169.4", "country": "DE", "asn": 25369, "org": "BANDWIDTH-AS - Hydra Communications Ltd, GB", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.14.254.25", "country": "GB", "asn": 25369, "org": "BANDWIDTH-AS - Hydra Communications Ltd, GB", "threat_score": 51.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "5.226.140.25", "country": "GB", "asn": 25369, "org": "BANDWIDTH-AS - Hydra Communications Ltd, GB", "threat_score": 31.0, "abuse_score": 100, "is_tor": false, "greynoise": "benign" }, { "ip": "195.140.214.27", "country": "GB", "asn": 25369, "org": "BANDWIDTH-AS - Hydra Communications Ltd, GB", "threat_score": 5.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "31.14.254.29", "country": "GB", "asn": 25369, "org": "BANDWIDTH-AS - Hydra Communications Ltd, GB", "threat_score": 3.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_0079dec6da0c", "hassh": "0079dec6da0c13e5e8d1ea56ca556b64", "tool": { "name": "libssh2_scanner", "classification": "scanner" }, "ip_count": 5, "avg_threat_score": 27.2, "countries": { "IT": 1, "DE": 1, "VE": 1, "KR": 2 }, "top_asns": { "AS4766": 2, "AS12874": 1, "AS396982": 1, "AS6306": 1 }, "organizations": [ "FASTWEB-MNT", "IP Manager", "Google LLC" ], "shared_credentials": [ { "username": "root", "password": "root", "ip_count": 5 } ], "shared_commands": [ { "cmd": "ps -ef | grep '[Mm]iner'", "ips": 5 }, { "cmd": "ps | grep '[Mm]iner'", "ips": 5 }, { "cmd": "echo Hi | cat -n", "ips": 5 }, { "cmd": "/ip cloud print", "ips": 5 }, { "cmd": "cat /proc/cpuinfo", "ips": 5 }, { "cmd": "locate D877F783D5D3EF8Cs", "ips": 4 }, { "cmd": "ls -la ~/.local/share/TelegramDesktop/tdata /home/*/.local/share/TelegramDesktop/tdata /dev/ttyGSM* ", "ips": 4 } ], "deep_enrichment_coverage": { "34.159.18.221": [ "otx", "shodan" ], "200.71.154.142": [ "otx", "dshield" ], "93.62.72.229": [ "ipinfo" ] }, "sample_ips": [ { "ip": "93.62.72.229", "country": "IT", "asn": 12874, "org": "FASTWEB - Fastweb SpA, IT", "threat_score": 61.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "34.159.18.221", "country": "DE", "asn": 396982, "org": "GOOGLE-CLOUD-PLATFORM - Google LLC, US", "threat_score": 55.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "200.71.154.142", "country": "VE", "asn": 6306, "org": "AS6306 - TELEFONICA VENEZOLANA, C.A., VE", "threat_score": 9.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "121.183.240.55", "country": "KR", "asn": 4766, "org": "KIXS-AS-KR-KR - Korea Telecom, KR", "threat_score": 6.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "218.145.181.48", "country": "KR", "asn": 4766, "org": "KIXS-AS-KR-KR - Korea Telecom, KR", "threat_score": 5.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_ae8bd7dd0997", "hassh": "ae8bd7dd09970555aa4c6ed22adbbf56", "tool": null, "ip_count": 5, "avg_threat_score": 40.0, "countries": { "MX": 1, "HU": 1, "CO": 1, "TR": 1, "TW": 1 }, "top_asns": { "AS8151": 1, "AS5483": 1, "AS27831": 1, "AS15897": 1, "AS3462": 1 }, "organizations": [ "HINET Network-Adm", "Magyar Telekom Network Administrator", "Uninet S.A. de C.V.", "Colombia M\u00f3vil", "RTNET-MNT" ], "shared_credentials": [ { "username": "pi", "password": "raspberry", "ip_count": 5 }, { "username": "pi", "password": "raspberryraspberry993311", "ip_count": 5 } ], "shared_commands": [], "deep_enrichment_coverage": { "79.122.49.48": [ "virustotal", "otx" ], "187.225.116.171": [ "virustotal", "otx", "dshield" ], "177.253.168.2": [ "otx", "dshield", "shodan" ], "125.227.156.55": [ "dshield" ], "46.154.237.78": [ "otx", "dshield", "ipinfo", "abuseipdb" ] }, "sample_ips": [ { "ip": "187.225.116.171", "country": "MX", "asn": 8151, "org": "AS8151 - UNINET, MX", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "79.122.49.48", "country": "HU", "asn": 5483, "org": "MAGYAR-TELEKOM-MAIN-AS - Magyar Telekom Plc., HU", "threat_score": 54.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "177.253.168.2", "country": "CO", "asn": 27831, "org": "AS27831 - Colombia Movil, CO", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "46.154.237.78", "country": "TR", "asn": 15897, "org": "VodafoneTurkey - Vodafone Telekomunikasyon A.S., TR", "threat_score": 24.8, "abuse_score": 32, "is_tor": false, "greynoise": null }, { "ip": "125.227.156.55", "country": "TW", "asn": 3462, "org": "HINET - Data Communication Business Group, TW", "threat_score": 12.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_c8c5fbf80b7b", "hassh": "c8c5fbf80b7b0a1b0e4de5e683f3c5ad", "tool": { "name": "libssh-0.7.3", "classification": "unknown" }, "ip_count": 5, "avg_threat_score": 16.4, "countries": { "US": 4, "AU": 1 }, "top_asns": { "AS7922": 1, "AS4181": 1, "AS20055": 1, "AS7545": 1, "AS11404": 1 }, "organizations": [ "Wave Broadband", "TPG Internet Pty Ltd.", "TDS TELECOM", "Comcast Cable Communications, LLC", "Ziply Fiber" ], "shared_credentials": [ { "username": "ubuntu", "password": "ubuntu", "ip_count": 4 } ], "shared_commands": [], "deep_enrichment_coverage": { "75.100.67.53": [ "otx" ], "73.204.186.147": [ "otx", "dshield", "shodan" ], "50.46.141.125": [ "otx" ] }, "sample_ips": [ { "ip": "73.204.186.147", "country": "US", "asn": 7922, "org": "COMCAST-7922 - Comcast Cable Communications, LLC, US", "threat_score": 32.4, "abuse_score": 61, "is_tor": false, "greynoise": null }, { "ip": "75.100.67.53", "country": "US", "asn": 4181, "org": "TDS-AS - TDS TELECOM, US", "threat_score": 28.8, "abuse_score": 57, "is_tor": false, "greynoise": null }, { "ip": "50.46.141.125", "country": "US", "asn": 20055, "org": "AS-WHOLESAIL - Wholesail networks LLC, US", "threat_score": 13.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "203.219.39.130", "country": "AU", "asn": 7545, "org": "TPG-INTERNET-AP - TPG Telecom Limited, AU", "threat_score": 6.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "24.143.110.37", "country": "US", "asn": 11404, "org": "AS-WAVE-1 - Wave Broadband, US", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_57e4cc8ee36c", "hassh": "57e4cc8ee36c3d78f75c6a05acd55963", "tool": { "name": "paramiko_script", "classification": "script" }, "ip_count": 5, "avg_threat_score": 58.2, "countries": { "SE": 2, "LV": 2, "GB": 1 }, "top_asns": { "AS42237": 3, "AS43513": 1, "AS42099": 1 }, "organizations": [ "Anastasiia", "Sia Nano IT", "RIPE-NCC-END-MNT", "RIPE-NCC-HM-MNT" ], "shared_credentials": [ { "username": "admin", "password": "123456", "ip_count": 4 }, { "username": "admin", "password": "admin", "ip_count": 4 } ], "shared_commands": [], "deep_enrichment_coverage": { "185.246.128.133": [ "active_recon", "virustotal", "ipinfo", "abuseipdb", "otx", "dshield", "censys", "shodan" ], "31.170.22.196": [ "active_recon", "virustotal", "ipinfo", "abuseipdb", "greynoise", "otx", "shodan" ], "193.105.134.45": [ "ipinfo", "abuseipdb", "otx", "shodan" ] }, "sample_ips": [ { "ip": "185.246.128.133", "country": "SE", "asn": 42237, "org": "w1n - Anastasiia Hein, UA", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": "suspicious" }, { "ip": "193.105.134.45", "country": "SE", "asn": 42237, "org": "w1n - w1n ltd, GB", "threat_score": 100.0, "abuse_score": 99, "is_tor": false, "greynoise": null }, { "ip": "31.170.22.196", "country": "LV", "asn": 43513, "org": "NANO-AS - Sia Nano IT, LV", "threat_score": 84.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "31.170.22.205", "country": "LV", "asn": 42099, "org": "Sia Nano IT", "threat_score": 5.0, "abuse_score": null, "is_tor": false, "greynoise": null }, { "ip": "193.105.134.95", "country": "GB", "asn": 42237, "org": "w1n - w1n ltd, GB", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_1f2f2f9b0a73", "hassh": "1f2f2f9b0a736952f743e5490c64c98a", "tool": { "name": "libssh_botnet", "classification": "botnet" }, "ip_count": 5, "avg_threat_score": 98.6, "countries": { "NL": 3, "RO": 2 }, "top_asns": { "AS213474": 2, "AS204428": 2, "AS211736": 1 }, "organizations": [ "TOV E-RISHENNYA", "Vlad Cojuhari", "UNMANAGED", "Abuse-C Role" ], "shared_credentials": [ { "username": "support", "password": "support", "ip_count": 5 }, { "username": "root", "password": "", "ip_count": 5 }, { "username": "root", "password": "admin", "ip_count": 4 }, { "username": "telecomadmin", "password": "admintelecom", "ip_count": 4 }, { "username": "admin", "password": "admin", "ip_count": 4 }, { "username": "admin", "password": "admin01", "ip_count": 3 }, { "username": "root", "password": "Password", "ip_count": 3 }, { "username": "RPM", "password": "RPM", "ip_count": 3 }, { "username": "admin", "password": "admin1234", "ip_count": 3 }, { "username": "anonymous", "password": "", "ip_count": 3 }, { "username": "root", "password": "Aa123456", "ip_count": 3 }, { "username": "ubnt", "password": "ubnt123", "ip_count": 3 }, { "username": "support", "password": "supportAtlanta", "ip_count": 2 }, { "username": "test", "password": "test", "ip_count": 2 }, { "username": "ubnt", "password": "1234", "ip_count": 2 }, { "username": "ubnt", "password": "ubnt", "ip_count": 2 }, { "username": "ubuntu", "password": "ubuntu", "ip_count": 2 }, { "username": "user", "password": "user", "ip_count": 2 }, { "username": "admin", "password": "123456", "ip_count": 2 }, { "username": "admin", "password": "12345678", "ip_count": 2 }, { "username": "admin", "password": "Admin123", "ip_count": 2 }, { "username": "admin", "password": "Admin@1234", "ip_count": 2 }, { "username": "admin", "password": "vivo12345", "ip_count": 2 }, { "username": "lab", "password": "lab123", "ip_count": 2 }, { "username": "operator", "password": "operator", "ip_count": 2 }, { "username": "root", "password": "0", "ip_count": 2 }, { "username": "root", "password": "123456", "ip_count": 2 }, { "username": "root", "password": "P@55w0rd!", "ip_count": 2 }, { "username": "sshd", "password": "", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "138.226.239.233": [ "active_recon", "virustotal", "otx", "censys", "shodan" ], "80.94.95.116": [ "otx", "shodan" ], "138.226.239.234": [ "otx", "censys", "shodan" ], "185.156.73.233": [ "ipinfo", "abuseipdb", "otx", "active_recon" ], "80.94.95.115": [ "abuseipdb", "otx", "dshield", "shodan" ] }, "sample_ips": [ { "ip": "138.226.239.233", "country": "NL", "asn": 213474, "org": "HOMELINE-AS - HomeLine Broadband LLC, US", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.156.73.233", "country": "NL", "asn": 211736, "org": "FDN3 - FOP Dmytro Nedilskyi, UA", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "80.94.95.115", "country": "RO", "asn": 204428, "org": "SS-Net - SS-Net, BG", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "80.94.95.116", "country": "RO", "asn": 204428, "org": "SS-Net - SS-Net, BG", "threat_score": 99.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "138.226.239.234", "country": "NL", "asn": 213474, "org": "HOMELINE-AS - HomeLine Broadband LLC, US", "threat_score": 94.0, "abuse_score": 100, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_f0dae8afad40", "hassh": "f0dae8afad40e79868006dda460a3625", "tool": null, "ip_count": 5, "avg_threat_score": 30.2, "countries": { "SE": 2, "FI": 1, "PH": 1, "ID": 1 }, "top_asns": { "AS35100": 1, "AS210644": 1, "AS17970": 1, "AS138810": 1, "AS200019": 1 }, "organizations": [ "IRT-GLOSINDO-ID", "ALEXHOST SRL", "Sky Cable Corporation", "NetCrafters OU" ], "shared_credentials": [ { "username": "root", "password": "dP2b", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "171.25.158.95": [ "otx", "dshield", "shodan" ], "103.134.220.144": [ "otx", "dshield", "shodan" ], "103.239.201.50": [ "pulsedive", "otx", "dshield", "shodan" ], "62.60.149.161": [ "otx", "shodan" ], "81.177.212.101": [ "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "171.25.158.95", "country": "SE", "asn": 35100, "org": "PatrikWeb-Core - Patrik Lagerman, SE", "threat_score": 45.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "62.60.149.161", "country": "FI", "asn": 210644, "org": "AEZA-AS - AEZA GROUP LLC, RU", "threat_score": 39.6, "abuse_score": 89, "is_tor": false, "greynoise": null }, { "ip": "103.239.201.50", "country": "PH", "asn": 17970, "org": "SKYBB-AS-AP - SKYBroadband SKYCable Corporation, PH", "threat_score": 24.2, "abuse_score": 48, "is_tor": false, "greynoise": null }, { "ip": "103.134.220.144", "country": "ID", "asn": 138810, "org": "GLOSINDO-AS-ID - PT Global Media Pratama Solusindo, ID", "threat_score": 23.2, "abuse_score": 48, "is_tor": false, "greynoise": null }, { "ip": "81.177.212.101", "country": "SE", "asn": 200019, "org": "ALEXHOST SRL", "threat_score": 19.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_069fb483253f", "hassh": "069fb483253fc12ecaf3731bac1ae020", "tool": null, "ip_count": 5, "avg_threat_score": 42.8, "countries": { "VN": 1, "SG": 3, "GB": 1 }, "top_asns": { "AS142002": 2, "AS135377": 2, "AS63737": 1 }, "organizations": [ "Scloud Pte Ltd", "UCLOUD INFORMATION TECHNOLOGY HK LIMITED", "Asia Pacific Network Information Centre", "IRT-VNNIC-AP" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 5 }, { "username": "1", "password": "1", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "165.154.236.241": [ "censys", "shodan" ], "118.194.232.176": [ "otx", "shodan" ], "165.154.193.52": [ "otx", "shodan" ], "103.209.60.185": [ "otx" ], "152.32.157.220": [ "ipinfo", "abuseipdb", "otx", "dshield" ] }, "sample_ips": [ { "ip": "103.209.60.185", "country": "VN", "asn": 63737, "org": "VIETSERVER-AS-VN - VIETSERVER SERVICES TECHNOLOGY COMPANY LIMITED, VN", "threat_score": 53.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.193.52", "country": "SG", "asn": 142002, "org": "SCLOUDPTELTD-AS - Scloud Pte Ltd, SG", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "165.154.236.241", "country": "SG", "asn": 142002, "org": "SCLOUDPTELTD-AS - Scloud Pte Ltd, SG", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "118.194.232.176", "country": "SG", "asn": 135377, "org": "UCLOUD-HK-AS-AP - UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED, HK", "threat_score": 46.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "152.32.157.220", "country": "GB", "asn": 135377, "org": "Asia Pacific Network Information Centre", "threat_score": 19.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_390ffe68a68c", "hassh": "390ffe68a68c2a2891210413e80689fa", "tool": { "name": "openssh_modern", "classification": "modern" }, "ip_count": 5, "avg_threat_score": 96.3, "countries": { "NL": 3, "LT": 1, "RO": 1 }, "top_asns": { "AS213474": 2, "AS211736": 1, "AS213790": 1, "AS204428": 1 }, "organizations": [ "Limited Network LTD", "TOV E-RISHENNYA", "Vlad Cojuhari", "UNMANAGED" ], "shared_credentials": [ { "username": "root", "password": "", "ip_count": 5 }, { "username": "root", "password": "admin", "ip_count": 5 }, { "username": "admin", "password": "admin", "ip_count": 4 }, { "username": "ubuntu", "password": "ubuntu", "ip_count": 4 }, { "username": "root", "password": "123456", "ip_count": 3 }, { "username": "admin", "password": "123456", "ip_count": 3 }, { "username": "pi", "password": "raspberry", "ip_count": 3 }, { "username": "root", "password": "Aa123456", "ip_count": 3 }, { "username": "root", "password": "root123", "ip_count": 3 }, { "username": "support", "password": "support", "ip_count": 3 }, { "username": "telecomadmin", "password": "admintelecom", "ip_count": 3 }, { "username": "test", "password": "test", "ip_count": 3 }, { "username": "RPM", "password": "RPM", "ip_count": 2 }, { "username": "root", "password": "2wsx#EDC", "ip_count": 2 }, { "username": "ubnt", "password": "ubnt123", "ip_count": 2 }, { "username": "admin", "password": "Admin123", "ip_count": 2 }, { "username": "admin", "password": "12345678", "ip_count": 2 }, { "username": "sshd", "password": "", "ip_count": 2 }, { "username": "admin", "password": "admin1234", "ip_count": 2 }, { "username": "anonymous", "password": "", "ip_count": 2 }, { "username": "lab", "password": "lab123", "ip_count": 2 }, { "username": "operator", "password": "operator", "ip_count": 2 }, { "username": "ubnt", "password": "ubnt", "ip_count": 2 }, { "username": "admin", "password": "admin01", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "77.90.185.17": [ "active_recon", "abuseipdb", "otx" ], "138.226.239.233": [ "active_recon", "virustotal", "otx", "censys", "shodan" ], "138.226.239.234": [ "otx", "censys", "shodan" ], "185.156.73.233": [ "ipinfo", "abuseipdb", "otx", "active_recon" ], "80.94.95.118": [ "ipinfo", "abuseipdb" ] }, "sample_ips": [ { "ip": "138.226.239.233", "country": "NL", "asn": 213474, "org": "HOMELINE-AS - HomeLine Broadband LLC, US", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "185.156.73.233", "country": "NL", "asn": 211736, "org": "FDN3 - FOP Dmytro Nedilskyi, UA", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "77.90.185.17", "country": "LT", "asn": 213790, "org": "LimitedNetwork-AS - Limited Network LTD, GB", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "138.226.239.234", "country": "NL", "asn": 213474, "org": "HOMELINE-AS - HomeLine Broadband LLC, US", "threat_score": 94.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "80.94.95.118", "country": "RO", "asn": 204428, "org": "SS-Net - SS-Net, BG", "threat_score": 87.4, "abuse_score": 66, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_a289c065bf37", "hassh": "a289c065bf37397b69226bd770e33124", "tool": { "name": "go_scanner", "classification": "scanner" }, "ip_count": 4, "avg_threat_score": 31.0, "countries": { "TR": 1, "NL": 1, "US": 2 }, "top_asns": { "AS219502": 1, "AS51396": 1, "AS19318": 1, "AS14061": 1 }, "organizations": [ "FOP Danik Vyacheslav Evgenievich", "Interserver, Inc", "DigitalOcean, LLC", "Pfcloud UG" ], "shared_credentials": [ { "username": "admin", "password": "admin", "ip_count": 2 }, { "username": "root", "password": "admin", "ip_count": 2 } ], "shared_commands": [], "deep_enrichment_coverage": { "94.154.43.234": [ "otx" ], "176.65.148.44": [ "pulsedive", "otx", "dshield" ], "163.245.214.2": [ "dshield" ] }, "sample_ips": [ { "ip": "94.154.43.234", "country": "TR", "asn": 219502, "org": "STORMCLOUD-AS - Storm Industries LLC, US", "threat_score": 56.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "176.65.148.44", "country": "NL", "asn": 51396, "org": "PFCLOUD - Pfcloud UG (haftungsbeschrankt), DE", "threat_score": 52.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "163.245.214.2", "country": "US", "asn": 19318, "org": "IS-AS-1 - Interserver, Inc, US", "threat_score": 14.0, "abuse_score": 30, "is_tor": false, "greynoise": null }, { "ip": "147.182.151.123", "country": "US", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "threat_score": 2.0, "abuse_score": null, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_c1953cec4623", "hassh": "c1953cec4623dba5c2bdf4b16e831ea9", "tool": { "name": "libssh_botnet", "classification": "botnet" }, "ip_count": 4, "avg_threat_score": 87.2, "countries": { "CN": 4 }, "top_asns": { "AS9808": 3, "AS56046": 1 }, "organizations": [ "China Mobile", "China Mobile Communications Group Co., Ltd" ], "shared_credentials": [], "shared_commands": [], "deep_enrichment_coverage": { "36.134.211.170": [ "pulsedive", "virustotal", "otx", "shodan" ], "36.134.208.91": [ "pulsedive" ], "36.134.96.76": [ "virustotal", "otx", "dshield", "shodan" ], "36.137.249.148": [ "ipinfo", "abuseipdb", "otx" ] }, "sample_ips": [ { "ip": "36.134.211.170", "country": "CN", "asn": 9808, "org": "CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd., CN", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "36.134.96.76", "country": "CN", "asn": 56046, "org": "CMNET-Jiangsu-AP - China Mobile communications corporation, CN", "threat_score": 100.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "36.134.208.91", "country": "CN", "asn": 9808, "org": "CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd., CN", "threat_score": 89.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "36.137.249.148", "country": "CN", "asn": 9808, "org": "CHINAMOBILE-CN - China Mobile Communications Group Co., Ltd., CN", "threat_score": 60.0, "abuse_score": 100, "is_tor": false, "greynoise": null } ] }, { "cluster_id": "hassh_78c05d999799", "hassh": "78c05d999799066a2b4554ce7b1585a6", "tool": null, "ip_count": 4, "avg_threat_score": 41.4, "countries": { "CA": 1, "DE": 3 }, "top_asns": { "AS198967": 3, "AS577": 1 }, "organizations": [ "HB12603-MNT", "Bell Canada", "Cogent Communications, LLC" ], "shared_credentials": [ { "username": "pi", "password": "raspberry", "ip_count": 4 }, { "username": "pi", "password": "raspberryraspberry993311", "ip_count": 4 } ], "shared_commands": [], "deep_enrichment_coverage": { "149.50.63.189": [ "otx", "shodan" ], "70.54.68.107": [ "otx" ], "5.10.45.61": [ "greynoise", "otx" ] }, "sample_ips": [ { "ip": "70.54.68.107", "country": "CA", "asn": 577, "org": "BACOM - Bell Canada, CA", "threat_score": 48.0, "abuse_score": 100, "is_tor": false, "greynoise": null }, { "ip": "5.10.45.61", "country": "DE", "asn": 198967, "org": "BITel-Gesellschaft-fuer-Telekommunikation-AS - BITel Gesellschaft fuer Telekommunikation mbH, DE", "threat_score": 44.4, "abuse_score": 91, "is_tor": false, "greynoise": null }, { "ip": "149.50.63.189", "country": "DE", "asn": 198967, "org": "BITel-Gesellschaft-fuer-Telekommunikation-AS - BITel Gesellschaft fuer Telekommunikation mbH, DE", "threat_score": 38.4, "abuse_score": 76, "is_tor": false, "greynoise": null }, { "ip": "178.208.125.57", "country": "DE", "asn": 198967, "org": "BITel-Gesellschaft-fuer-Telekommunikation-AS - BITel Gesellschaft fuer Telekommunikation mbH, DE", "threat_score": 34.8, "abuse_score": 67, "is_tor": false, "greynoise": null } ] } ], "campaigns": [ { "name": "Shared Apache infrastructure", "strategy": "recon_fingerprint", "ip_count": 29, "first_seen": "2026-10-06T07:16:49.835860+00:00", "last_seen": "2026-10-06T07:16:49.835860+00:00", "description": "Auto-detected campaign: 29 IPs running Apache/None:443 with shared behavioral signals", "indicators": { "service_fingerprint": "Apache/None:443" } } ], "high_value_iocs": [ { "ip": "93.188.83.96", "country": "UZ", "asn": 8193, "org": "BRM-AS - _Uzbektelekom_ Joint Stock Company, UZ", "registrant": "\"Uzbektelekom\" Joint Stock Company", "threat_score": 100.0, "abuse_score": 92, "greynoise": "malicious", "is_tor": false, "hits": 34135, "successes": 1, "first_seen": "2026-08-27T06:07:55.990037+00:00", "last_seen": "2026-08-27T14:45:28.920745+00:00" }, { "ip": "110.173.190.221", "country": "IN", "asn": 17426, "org": "PRIMENET-AS-AP - Primesoftex Ltd, IN", "registrant": "IRT-PRIMENET-IN", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 21052, "successes": 8, "first_seen": "2026-08-13T08:50:04.856062+00:00", "last_seen": "2026-08-26T18:23:46.377841+00:00" }, { "ip": "217.60.255.130", "country": "IR", "asn": 204203, "org": "Sepehr-Sabz-DC-TEH - Atrin Information & Communications Technology Company PJS, IR", "registrant": "CTO", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 20988, "successes": 18, "first_seen": "2026-08-01T20:12:22.134248+00:00", "last_seen": "2026-08-13T18:28:26.375930+00:00" }, { "ip": "94.154.35.215", "country": "NL", "asn": 202412, "org": "OMEGATECH-AS - Omegatech LTD, SC", "registrant": "Individual entrepreneur Dyachenko Valentina Ivanovna", "threat_score": 100.0, "abuse_score": 83, "greynoise": "malicious", "is_tor": false, "hits": 19486, "successes": 10022, "first_seen": "2026-05-21T11:32:51.268513+00:00", "last_seen": "2026-09-16T21:32:27.285550+00:00" }, { "ip": "185.246.128.133", "country": "SE", "asn": 42237, "org": "w1n - Anastasiia Hein, UA", "registrant": "Anastasiia", "threat_score": 100.0, "abuse_score": 100, "greynoise": "suspicious", "is_tor": false, "hits": 19447, "successes": 11810, "first_seen": "2026-05-21T11:32:48.810970+00:00", "last_seen": "2026-10-26T17:05:55.207705+00:00" }, { "ip": "179.43.133.154", "country": "CH", "asn": 51852, "org": "PLI-AS - Private Layer INC, PA", "registrant": "PRIVATE LAYER INC", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 16013, "successes": 8514, "first_seen": "2026-05-21T11:32:48.572141+00:00", "last_seen": "2026-10-26T17:13:34.408635+00:00" }, { "ip": "179.43.139.58", "country": "CH", "asn": 51852, "org": "PLI-AS - Private Layer INC, PA", "registrant": "PRIVATE LAYER INC", "threat_score": 100.0, "abuse_score": 100, "greynoise": "suspicious", "is_tor": false, "hits": 15312, "successes": 9124, "first_seen": "2026-05-21T11:32:48.573376+00:00", "last_seen": "2026-10-26T16:26:46.607688+00:00" }, { "ip": "91.92.40.217", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 9089, "successes": 118, "first_seen": "2026-07-10T00:51:05.514075+00:00", "last_seen": "2026-08-22T20:31:17.999403+00:00" }, { "ip": "159.65.148.158", "country": "IN", "asn": 14061, "org": "DIGITALOCEAN-ASN - DigitalOcean, LLC, US", "registrant": "DigitalOcean, LLC", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 8901, "successes": 6, "first_seen": "2026-07-17T08:06:29.194557+00:00", "last_seen": "2026-08-20T15:45:08.037905+00:00" }, { "ip": "2.57.121.112", "country": "RO", "asn": 47890, "org": "UNMANAGED-DEDICATED-SERVERS - UNMANAGED LTD, GB", "registrant": "UNMANAGED LTD", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 8728, "successes": 0, "first_seen": "2026-07-11T21:39:40.822357+00:00", "last_seen": "2026-10-26T16:21:22.675562+00:00" }, { "ip": "91.92.47.123", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 8618, "successes": 40, "first_seen": "2026-07-17T23:07:54.089997+00:00", "last_seen": "2026-08-20T15:45:08.037905+00:00" }, { "ip": "109.160.32.108", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 8018, "successes": 41, "first_seen": "2026-09-11T06:04:48.800023+00:00", "last_seen": "2026-10-26T17:15:27.363194+00:00" }, { "ip": "45.153.34.235", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 7690, "successes": 100, "first_seen": "2026-06-28T09:29:12.444352+00:00", "last_seen": "2026-08-23T09:32:17.825766+00:00" }, { "ip": "109.160.32.39", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 7640, "successes": 78, "first_seen": "2026-09-06T22:28:09.142012+00:00", "last_seen": "2026-10-14T14:39:07.329396+00:00" }, { "ip": "109.160.32.151", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 7398, "successes": 397, "first_seen": "2026-10-12T12:55:18.198469+00:00", "last_seen": "2026-10-19T23:18:46.151624+00:00" }, { "ip": "202.165.25.8", "country": "MY", "asn": 18206, "org": "TTSSB-MY - TM TECHNOLOGY SERVICES SDN. BHD., MY", "registrant": "IRT-MY-WEBE", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 7306, "successes": 28, "first_seen": "2026-08-27T09:03:06.878810+00:00", "last_seen": "2026-09-18T02:03:30.847169+00:00" }, { "ip": "2.57.121.25", "country": "RO", "asn": 47890, "org": "UNMANAGED-DEDICATED-SERVERS - UNMANAGED LTD, GB", "registrant": "UNMANAGED LTD", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 6462, "successes": 0, "first_seen": "2026-07-11T21:20:51.931110+00:00", "last_seen": "2026-10-26T16:31:45.010871+00:00" }, { "ip": "45.156.87.34", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "suspicious", "is_tor": false, "hits": 6140, "successes": 80, "first_seen": "2026-07-03T11:28:54.214536+00:00", "last_seen": "2026-08-06T02:40:53.780878+00:00" }, { "ip": "91.92.42.133", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 6136, "successes": 80, "first_seen": "2026-06-23T19:42:04.786216+00:00", "last_seen": "2026-08-22T02:57:34.015617+00:00" }, { "ip": "91.92.47.55", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 5950, "successes": 50, "first_seen": "2026-07-24T20:45:04.657142+00:00", "last_seen": "2026-08-25T21:43:06.672552+00:00" }, { "ip": "193.46.255.86", "country": "RO", "asn": 47890, "org": "UNMANAGED-DEDICATED-SERVERS - UNMANAGED LTD, GB", "registrant": "UNMANAGED LTD", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 5837, "successes": 256, "first_seen": "2026-07-11T20:59:16.362552+00:00", "last_seen": "2026-10-26T16:40:32.245437+00:00" }, { "ip": "154.18.197.29", "country": "PH", "asn": 142271, "org": "DOUBLESQUARE-AS-AP - EWS DS Networks Inc, PH", "registrant": "Cogent Communications, LLC", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 5803, "successes": 25, "first_seen": "2026-09-11T18:21:56.911439+00:00", "last_seen": "2026-09-27T14:21:20.182304+00:00" }, { "ip": "109.160.32.75", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 5745, "successes": 76, "first_seen": "2026-09-14T09:35:38.312415+00:00", "last_seen": "2026-09-16T06:50:50.438869+00:00" }, { "ip": "45.153.34.112", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4958, "successes": 41, "first_seen": "2026-07-31T23:12:07.548705+00:00", "last_seen": "2026-08-17T07:58:37.979316+00:00" }, { "ip": "176.53.159.196", "country": "PL", "asn": 154383, "org": "ZWS-AS-AP - ZORNTECH WEB SOLUTIONS, BD", "registrant": "BearShield Technologies S.R.O.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4934, "successes": 2465, "first_seen": "2026-07-01T15:30:35.610226+00:00", "last_seen": "2026-10-26T16:49:27.925209+00:00" }, { "ip": "91.92.47.53", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4887, "successes": 60, "first_seen": "2026-08-03T00:12:31.311446+00:00", "last_seen": "2026-09-04T19:57:01.352434+00:00" }, { "ip": "91.92.40.153", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4638, "successes": 60, "first_seen": "2026-07-07T10:56:04.020005+00:00", "last_seen": "2026-09-04T01:38:28.456609+00:00" }, { "ip": "91.92.42.61", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4615, "successes": 60, "first_seen": "2026-06-19T13:37:44.152682+00:00", "last_seen": "2026-08-18T23:37:20.462970+00:00" }, { "ip": "91.92.40.171", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4607, "successes": 60, "first_seen": "2026-06-17T23:51:44.761496+00:00", "last_seen": "2026-08-04T04:09:49.729394+00:00" }, { "ip": "198.74.56.6", "country": "US", "asn": 63949, "org": "AKAMAI-LINODE-AP - Akamai Connected Cloud, SG", "registrant": "Linode", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4436, "successes": 0, "first_seen": "2026-05-27T04:24:04.431636+00:00", "last_seen": "2026-08-20T04:26:51.026778+00:00" }, { "ip": "77.239.124.201", "country": "NL", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "RocketCloud", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4143, "successes": 37, "first_seen": "2026-08-28T01:27:55.846173+00:00", "last_seen": "2026-09-19T10:35:23.572725+00:00" }, { "ip": "91.92.40.45", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 4052, "successes": 42, "first_seen": "2026-06-30T02:23:02.101604+00:00", "last_seen": "2026-08-24T22:04:09.136145+00:00" }, { "ip": "109.160.32.26", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3874, "successes": 38, "first_seen": "2026-09-11T17:31:39.732791+00:00", "last_seen": "2026-09-13T00:19:51.836975+00:00" }, { "ip": "91.92.40.43", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3700, "successes": 23, "first_seen": "2026-08-05T23:40:07.697109+00:00", "last_seen": "2026-08-30T04:44:32.372476+00:00" }, { "ip": "91.92.42.87", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3610, "successes": 40, "first_seen": "2026-07-15T12:22:25.983687+00:00", "last_seen": "2026-08-15T17:45:09.519446+00:00" }, { "ip": "91.92.40.50", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3472, "successes": 32, "first_seen": "2026-07-19T04:30:47.080424+00:00", "last_seen": "2026-08-29T03:50:59.059621+00:00" }, { "ip": "195.178.110.232", "country": "NL", "asn": 48090, "org": "DMZHOST - TECHOFF SRV LIMITED, GB", "registrant": "TECHOFF SRV LIMITED", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3396, "successes": 330, "first_seen": "2026-07-02T17:41:36.602958+00:00", "last_seen": "2026-10-25T22:22:35.965983+00:00" }, { "ip": "2.57.122.238", "country": "RO", "asn": 47890, "org": "UNMANAGED-DEDICATED-SERVERS - UNMANAGED LTD, GB", "registrant": "TECHOFF SRV LIMITED", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3375, "successes": 41, "first_seen": "2026-07-01T03:53:29.002899+00:00", "last_seen": "2026-10-24T20:31:46.881151+00:00" }, { "ip": "91.92.40.151", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3266, "successes": 40, "first_seen": "2026-07-14T05:18:46.797304+00:00", "last_seen": "2026-08-28T03:11:43.921331+00:00" }, { "ip": "195.178.110.228", "country": "NL", "asn": 48090, "org": "DMZHOST - TECHOFF SRV LIMITED, GB", "registrant": "TECHOFF SRV LIMITED", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3252, "successes": 298, "first_seen": "2026-07-07T02:50:48.888105+00:00", "last_seen": "2026-10-19T08:48:40.496493+00:00" }, { "ip": "91.92.42.64", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3200, "successes": 40, "first_seen": "2026-07-22T20:05:56.044079+00:00", "last_seen": "2026-09-03T08:59:11.726787+00:00" }, { "ip": "109.160.32.86", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3200, "successes": 20, "first_seen": "2026-09-09T00:25:41.193676+00:00", "last_seen": "2026-09-26T06:18:01.816705+00:00" }, { "ip": "109.160.32.35", "country": "DE", "asn": 198364, "org": "BANATSYNC-SRL - BANATSYNC SRL, RO", "registrant": "Global Communication Net Plc", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3197, "successes": 20, "first_seen": "2026-09-20T00:17:14.130582+00:00", "last_seen": "2026-10-08T03:51:16.599373+00:00" }, { "ip": "91.92.40.202", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3192, "successes": 41, "first_seen": "2026-06-30T03:12:08.923380+00:00", "last_seen": "2026-08-23T19:07:58.028183+00:00" }, { "ip": "91.92.40.19", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3121, "successes": 41, "first_seen": "2026-07-01T10:40:37.070137+00:00", "last_seen": "2026-07-27T10:53:25.220880+00:00" }, { "ip": "45.156.87.166", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3091, "successes": 40, "first_seen": "2026-07-24T16:44:50.866518+00:00", "last_seen": "2026-09-03T14:35:26.289831+00:00" }, { "ip": "91.92.42.147", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3054, "successes": 40, "first_seen": "2026-06-15T10:34:49.891319+00:00", "last_seen": "2026-07-17T10:45:08.126503+00:00" }, { "ip": "91.92.42.10", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 3047, "successes": 40, "first_seen": "2026-06-26T07:53:29.533349+00:00", "last_seen": "2026-07-24T00:00:07.838596+00:00" }, { "ip": "91.92.47.90", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 2948, "successes": 20, "first_seen": "2026-07-15T10:20:44.343675+00:00", "last_seen": "2026-07-31T14:26:57.423345+00:00" }, { "ip": "45.153.34.71", "country": "NL", "asn": 197170, "org": "TECHTIES-AS - TechTies Inc., SC", "registrant": "TechTies Inc.", "threat_score": 100.0, "abuse_score": 100, "greynoise": "malicious", "is_tor": false, "hits": 2901, "successes": 26, "first_seen": "2026-07-28T02:36:00.088271+00:00", "last_seen": "2026-08-21T22:52:43.769563+00:00" } ], "hostile_networks": [ { "asn": 198364, "name": "Banatsync SRL", "country": "RO", "risk_score": 94.198586, "total_ips": 162, "threat_ips": 150 }, { "asn": 47890, "name": "UNMANAGED-DEDICATED-SERVERS UNMANAGED LTD", "country": "GB", "risk_score": 88.7225, "total_ips": 32, "threat_ips": 25 }, { "asn": 203214, "name": "HulumTele Hulum Almustakbal Company for Communication Engineering and Services Ltd", "country": "IQ", "risk_score": 88.62384, "total_ips": 64, "threat_ips": 36 }, { "asn": 197170, "name": "TechTies Inc.", "country": "SC", "risk_score": 88.48804, "total_ips": 185, "threat_ips": 118 }, { "asn": 209366, "name": "SEMrush CY LTD", "country": "CY", "risk_score": 87.8195, "total_ips": 40, "threat_ips": 32 }, { "asn": 197769, "name": "VPS Dedicated LLC", "country": "US", "risk_score": 87.3272, "total_ips": 37, "threat_ips": 26 }, { "asn": 62390, "name": "NEXONHOST NexonHost Srl", "country": "RO", "risk_score": 85.23177, "total_ips": 13, "threat_ips": 12 }, { "asn": 14670, "name": "WHG Hosting Services Ltd", "country": "GB", "risk_score": 85.15433, "total_ips": 16, "threat_ips": 13 }, { "asn": 198584, "name": "PIO-Hosting PIO-Hosting GmbH", "country": "DE", "risk_score": 84.39, "total_ips": 20, "threat_ips": 14 }, { "asn": 25159, "name": "PJSC MegaFon", "country": "RU", "risk_score": 84.098976, "total_ips": 31, "threat_ips": 21 }, { "asn": 213790, "name": "LimitedNetwork", "country": "GB", "risk_score": 82.16587, "total_ips": 36, "threat_ips": 21 }, { "asn": 6939, "name": "Hurricane Electric LLC", "country": "US", "risk_score": 82.14003, "total_ips": 161, "threat_ips": 2 }, { "asn": 398324, "name": "Censys, Inc.", "country": "US", "risk_score": 81.99656, "total_ips": 108, "threat_ips": 0 }, { "asn": 38513, "name": "PT Aplikanusa Lintasarta", "country": "ID", "risk_score": 81.60625, "total_ips": 6, "threat_ips": 6 }, { "asn": 57374, "name": "GIV-AS Company for communications services A1 Makedonija DOOEL Skopje", "country": "MK", "risk_score": 81.60625, "total_ips": 6, "threat_ips": 6 }, { "asn": 48090, "name": "DMZHOST TECHOFF SRV LIMITED", "country": "GB", "risk_score": 81.57833, "total_ips": 18, "threat_ips": 13 }, { "asn": 32475, "name": "Internap Holding LLC", "country": "US", "risk_score": 81.54224, "total_ips": 51, "threat_ips": 28 }, { "asn": 4818, "name": "DiGi Telecommunications Sdn. Bhd.", "country": "MY", "risk_score": 81.52078, "total_ips": 159, "threat_ips": 1 }, { "asn": 199457, "name": "SolidCore Hosting LTD", "country": "VG", "risk_score": 81.4554, "total_ips": 22, "threat_ips": 13 }, { "asn": 63199, "name": "CDS Global Cloud Co., Ltd", "country": "US", "risk_score": 80.85625, "total_ips": 6, "threat_ips": 6 }, { "asn": 208949, "name": "HBING LIMITED", "country": "GB", "risk_score": 80.54, "total_ips": 5, "threat_ips": 5 }, { "asn": 132203, "name": "Tencent", "country": "CN", "risk_score": 79.36639, "total_ips": 314, "threat_ips": 74 }, { "asn": 8473, "name": "Bahnhof AB", "country": "SE", "risk_score": 79.34764, "total_ips": 51, "threat_ips": 23 }, { "asn": 150436, "name": "Byteplus Pte. Ltd.", "country": "SG", "risk_score": 79.34398, "total_ips": 84, "threat_ips": 37 }, { "asn": 131353, "name": "NhanHoa Software company", "country": "VN", "risk_score": 79.33182, "total_ips": 12, "threat_ips": 7 }, { "asn": 134810, "name": "China Mobile Group JiLin Communications Corporation", "country": "CN", "risk_score": 79.19367, "total_ips": 23, "threat_ips": 4 }, { "asn": 3301, "name": "Telia Company AB", "country": "SE", "risk_score": 78.95086, "total_ips": 49, "threat_ips": 18 }, { "asn": 56005, "name": "Fastidc - Zhengzhou Fastidc Technology Co.,Ltd.", "country": "CN", "risk_score": 78.745, "total_ips": 10, "threat_ips": 5 }, { "asn": 131423, "name": "Branch of Long Van System Solution JSC - Hanoi", "country": "VN", "risk_score": 78.60833, "total_ips": 8, "threat_ips": 5 }, { "asn": 23470, "name": "ReliableSite.Net LLC", "country": "US", "risk_score": 78.1018, "total_ips": 27, "threat_ips": 16 }, { "asn": 8193, "name": "Uzbektelekom Joint Stock Company", "country": "UZ", "risk_score": 77.74064, "total_ips": 84, "threat_ips": 3 }, { "asn": 402253, "name": "SKN Subnet & Telecom Ltd", "country": "KN", "risk_score": 77.671776, "total_ips": 13, "threat_ips": 6 }, { "asn": 219502, "name": "Storm Industries LLC", "country": "US", "risk_score": 77.66722, "total_ips": 43, "threat_ips": 8 }, { "asn": 398101, "name": "GoDaddy.com, LLC", "country": "US", "risk_score": 77.633446, "total_ips": 34, "threat_ips": 19 }, { "asn": 133774, "name": "Fuzhou", "country": "CN", "risk_score": 77.10833, "total_ips": 8, "threat_ips": 5 }, { "asn": 205759, "name": "Ghosty Networks LLC", "country": "US", "risk_score": 77.1, "total_ips": 11, "threat_ips": 6 }, { "asn": 131386, "name": "Long Van System Solution JSC", "country": "VN", "risk_score": 76.90625, "total_ips": 6, "threat_ips": 5 }, { "asn": 41668, "name": "ERTH-KAZAN-AS JSC \"ER-Telecom Holding\"", "country": "RU", "risk_score": 76.63684, "total_ips": 9, "threat_ips": 5 }, { "asn": 208137, "name": "FPS12 Feo Prest SRL", "country": "RO", "risk_score": 76.61596, "total_ips": 31, "threat_ips": 14 }, { "asn": 40676, "name": "Psychz Networks", "country": "US", "risk_score": 76.590836, "total_ips": 37, "threat_ips": 9 }, { "asn": 401661, "name": "EMBNEX, LLC", "country": "US", "risk_score": 76.4225, "total_ips": 30, "threat_ips": 0 }, { "asn": 215925, "name": "VPSVAULT.HOST LTD", "country": "GB", "risk_score": 76.402084, "total_ips": 32, "threat_ips": 4 }, { "asn": 31898, "name": "Oracle Corporation", "country": "US", "risk_score": 76.189644, "total_ips": 263, "threat_ips": 64 }, { "asn": 44382, "name": "WhiteLabel Fiba Cloud Operation Company, LLC", "country": "US", "risk_score": 76.12295, "total_ips": 21, "threat_ips": 5 }, { "asn": 19871, "name": "Network Solutions, LLC", "country": "US", "risk_score": 76.004, "total_ips": 15, "threat_ips": 9 }, { "asn": 46475, "name": "Limestone Networks, Inc.", "country": "US", "risk_score": 75.87273, "total_ips": 11, "threat_ips": 5 }, { "asn": 4812, "name": "China Telecom (Group)", "country": "CN", "risk_score": 75.70024, "total_ips": 34, "threat_ips": 9 }, { "asn": 215224, "name": "NovoServe B.V.", "country": "NL", "risk_score": 75.683334, "total_ips": 8, "threat_ips": 4 }, { "asn": 209334, "name": "Modat B.V.", "country": "NL", "risk_score": 75.65731, "total_ips": 97, "threat_ips": 0 }, { "asn": 133119, "name": "China Unicom IP network", "country": "CN", "risk_score": 75.52029, "total_ips": 23, "threat_ips": 7 } ], "attack_tools": [ { "hassh": "03a80b21afa810682a776a7d42e5e6fb", "tool_name": "libssh_0.11.x", "classification": "scanner", "ips_observed": 1313, "first_seen": "2026-03-28T19:10:58.314339+00:00", "last_seen": "2026-05-21T11:43:03.621549+00:00" }, { "hassh": "14b2ddda386a4d1006108ccd231b42fc", "tool_name": "libssh2_1.11.0", "classification": "scanner", "ips_observed": 628, "first_seen": "2026-05-02T23:16:51.377535+00:00", "last_seen": "2026-05-21T11:30:41.147466+00:00" }, { "hassh": "af8223ac9914f509afdadfaf5f7ee94e", "tool_name": "libssh_0.12.0", "classification": "scanner", "ips_observed": 607, "first_seen": "2026-04-21T09:27:14.507235+00:00", "last_seen": "2026-05-20T16:28:03.160090+00:00" }, { "hassh": "f555226df1963d1d3c09daf865abdc9a", "tool_name": "libssh_0.9.6", "classification": "botnet", "ips_observed": 421, "first_seen": "2026-03-29T04:41:48.159198+00:00", "last_seen": "2026-05-21T12:00:04.324015+00:00" }, { "hassh": "16443846184eafde36765c9bab2f4397", "tool_name": "Go_SSH", "classification": "scanner", "ips_observed": 320, "first_seen": "2026-03-24T23:41:57.517630+00:00", "last_seen": "2026-05-21T11:59:54.765693+00:00" }, { "hassh": "fda360b1b4f4d3455cb75c6e7edb1d11", "tool_name": "AsyncSSH_2.1.0", "classification": "scanner", "ips_observed": 92, "first_seen": "2026-03-24T14:09:11.165597+00:00", "last_seen": "2026-05-20T22:50:41.346143+00:00" }, { "hassh": "f45fb203c31069bb280067b71ed92ccb", "tool_name": "libssh_0.10.x", "classification": "scanner", "ips_observed": 34, "first_seen": "2026-03-21T08:11:47.107630+00:00", "last_seen": "2026-05-20T19:34:53.214409+00:00" }, { "hassh": "0a07365cc01fa9fc82608ba4019af499", "tool_name": "libssh2_1.11.1", "classification": "scanner", "ips_observed": 31, "first_seen": "2026-03-21T16:00:08.760276+00:00", "last_seen": "2026-05-19T12:21:07.929249+00:00" }, { "hassh": "98f63c4d9c87edbd97ed4747fa031019", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 23, "first_seen": "2026-03-24T07:19:18.858563+00:00", "last_seen": "2026-05-15T12:57:31.221671+00:00" }, { "hassh": "b4b8ae3d7241d2c1dc54b4df7e8c19d1", "tool_name": "libssh2_scanner", "classification": "scanner", "ips_observed": 21, "first_seen": "2026-04-23T07:48:02.313519+00:00", "last_seen": "2026-05-21T03:42:48.882126+00:00" }, { "hassh": "63ae64767f334c6a74647d80edb0291e", "tool_name": "libssh2_scanner", "classification": "scanner", "ips_observed": 14, "first_seen": "2026-04-03T20:40:21.248534+00:00", "last_seen": "2026-05-20T02:49:54.504797+00:00" }, { "hassh": "f93d28ee0c77e2612b27491518d909f4", "tool_name": "libssh_botnet", "classification": "botnet", "ips_observed": 12, "first_seen": "2026-04-30T10:55:59.209044+00:00", "last_seen": "2026-05-05T20:14:46.013236+00:00" }, { "hassh": "4c6bc5bc5953c531bde125c3af0ecc84", "tool_name": "libssh2_scanner", "classification": "scanner", "ips_observed": 11, "first_seen": "2026-04-01T16:23:06.171933+00:00", "last_seen": "2026-04-01T18:50:35.371291+00:00" }, { "hassh": "2aec6b44b06bec95d73f66b5d30cb69a", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 11, "first_seen": "2026-03-21T14:39:53.803644+00:00", "last_seen": "2026-05-21T07:22:24.753269+00:00" }, { "hassh": "bc3aee897af7d3feb9fc37b89c7d15c9", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 10, "first_seen": "2026-03-21T16:56:13.789780+00:00", "last_seen": "2026-05-20T13:31:05.888761+00:00" }, { "hassh": "7216c7c473918b4f83d1139b3c70dbf9", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 10, "first_seen": "2026-03-25T15:03:14.679861+00:00", "last_seen": "2026-04-04T14:11:00.228031+00:00" }, { "hassh": "2ec37a7cc8daf20b10e1ad6221061ca5", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 9, "first_seen": "2026-03-21T12:16:54.589176+00:00", "last_seen": "2026-04-14T07:39:32.211897+00:00" }, { "hassh": "eff4c24daffc8532c160e86e5f006e53", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 6, "first_seen": "2026-03-26T03:57:26.541331+00:00", "last_seen": "2026-05-21T11:45:33.281322+00:00" }, { "hassh": "6a77bbd6ef48d6a9959a47aa4a42a505", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 6, "first_seen": "2026-03-25T05:45:46.655388+00:00", "last_seen": "2026-04-03T05:55:59.000902+00:00" }, { "hassh": "e54ef3ec27fe1fea7ab64d3fa05359fd", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 5, "first_seen": "2026-03-25T15:15:26.912045+00:00", "last_seen": "2026-05-04T00:13:58.805083+00:00" }, { "hassh": "864cef7e4d8ad71d4fb1aadfcf0a3189", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 4, "first_seen": "2026-03-31T02:30:56.463444+00:00", "last_seen": "2026-05-12T19:34:22.317774+00:00" }, { "hassh": "087ab61de4f8afa9ac8f30c1b7c418eb", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 4, "first_seen": "2026-05-05T16:21:15.756430+00:00", "last_seen": "2026-05-11T10:46:21.264673+00:00" }, { "hassh": "a7a87fbe86774c2e40cc4a7ea2ab1b3c", "tool_name": "libssh2_scanner", "classification": "scanner", "ips_observed": 4, "first_seen": "2026-03-21T09:25:22.704618+00:00", "last_seen": "2026-05-21T11:45:05.084911+00:00" }, { "hassh": "44ac1859818d6cacfb48ec9cb230b3f0", "tool_name": "libssh2_scanner", "classification": "scanner", "ips_observed": 3, "first_seen": "2026-03-24T20:35:39.397717+00:00", "last_seen": "2026-04-08T09:23:15.954709+00:00" }, { "hassh": "0dacd47560840d74b6314f42705ed68a", "tool_name": "go_scanner", "classification": "scanner", "ips_observed": 3, "first_seen": "2026-04-06T10:43:51.964368+00:00", "last_seen": "2026-04-11T19:50:15.326322+00:00" } ], "samples": [ { "type": "file-sha256", "sha256": "f88e93f13ce58ade590513d5339358af5dbc2b6fad30f5da361ae4e5692d2065", "family": "IRC Botnet Loader", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-05-21T16:35:08.557332+00:00", "last_seen": "2026-08-09T00:05:13.011645+00:00" }, { "type": "file-sha256", "sha256": "9cbbeb3f16791eb75f9dd1311268e2d6f584d442320b1ff453c5e12903b30f7b", "family": "IRC Botnet Loader", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-04-19T04:42:21.685157+00:00", "last_seen": "2026-10-01T15:01:00.335994+00:00" }, { "type": "file-sha256", "sha256": "928044fd2ceade5d679bd0426013c0f6a377438fff1e70ef3e0e19e2659cad2f", "family": "IRC botnet dropper", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-09-05T14:29:27.989262+00:00", "last_seen": "2026-09-05T14:29:27.989262+00:00" }, { "type": "file-sha256", "sha256": "e0b2f2eeb23d7e3c71febe7ad0675bde07cdba2f91d827ee84e23758e08f3656", "family": "XMRig", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-04-11T17:21:01.347441+00:00", "last_seen": "2026-04-12T21:05:13.871388+00:00" }, { "type": "file-sha256", "sha256": "783565adc1ddbf9dab030a11f90d0c5897949504140a4c52458a3b7236f10486", "family": "Bins", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-05-19T02:27:32.120652+00:00", "last_seen": "2026-05-19T02:27:32.120652+00:00" }, { "type": "file-sha256", "sha256": "75300610d2c17b6e65766babd1878ef1d933eabeb78e50b9487fbb1a9572b7fc", "family": "IRC Botnet Loader", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-07-17T15:12:20.601989+00:00", "last_seen": "2026-10-02T12:19:03.151994+00:00" }, { "type": "file-sha256", "sha256": "ef5c9406cd1b9c99f30d32317cab5565ff1d1d912265a7400365016abca21a2e", "family": "IRC Botnet Dropper", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-03-28T09:32:39.214957+00:00", "last_seen": "2026-03-28T09:32:39.214957+00:00" }, { "type": "file-sha256", "sha256": "1ece1d43b28e3b38f2941bcb8a658067238abdfef0ce6f82f99d444b830dee90", "family": "IRC Botnet Loader", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-07-15T09:29:55.748488+00:00", "last_seen": "2026-07-15T09:29:55.748488+00:00" }, { "type": "file-sha256", "sha256": "e53619ba943f2780f1ec5022fecd0bf50c38789c5c56ab39b256b7331d014e03", "family": "XMRig", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-06-20T16:44:30.933985+00:00", "last_seen": "2026-06-20T16:44:30.933985+00:00" }, { "type": "file-sha256", "sha256": "d946dbc57684f968666466909956619625332e869731f95d11152fd48d104fad", "family": "XMRig", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-06-06T02:37:13.966083+00:00", "last_seen": "2026-06-06T02:37:13.966083+00:00" }, { "type": "file-sha256", "sha256": "249512a11240bba57171c0b5438b5a4d06ee2d751125957cda54d978c8a474eb", "family": "Kaiten", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-09-16T21:51:24.980137+00:00", "last_seen": "2026-09-16T21:51:24.980137+00:00" }, { "type": "file-sha256", "sha256": "6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b", "family": "IRC Botnet Dropper", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-04-23T23:07:44.431859+00:00", "last_seen": "2026-08-25T17:52:42.514892+00:00" }, { "type": "file-sha256", "sha256": "603dd8562b98ed7e13618d591a2d359f02a3d33b5b8787435aaa0d06f2bf1451", "family": "XMRig", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-06-13T13:18:31.366606+00:00", "last_seen": "2026-06-13T13:18:31.366606+00:00" }, { "type": "file-sha256", "sha256": "595a0565461528e335b8a4c3e93f305bec04089c04a641c233e28a26ffca40d6", "family": "IRC botnet loader", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-03-25T10:19:02.227619+00:00", "last_seen": "2026-08-25T10:29:26.028090+00:00" }, { "type": "file-sha256", "sha256": "a151d3f4f2422531f30a843ffb35479596c86722bb103bdf8591105687f9b125", "family": "XMRig", "severity": 100, "attack": [ "T1037", "T1053", "T1105", "T1222", "T1496", "T1562.001" ], "cves": [], "first_seen": "2026-10-24T21:54:09.378993+00:00", "last_seen": "2026-10-26T16:55:43.520589+00:00" }, { "type": "file-sha256", "sha256": "b4c8f6e4e5ca7f71f5b94470d34880aa66d25bf88bbf405a0365ba3ef15db829", "family": "IRC Bot Backdoor", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-06-25T23:58:59.604288+00:00", "last_seen": "2026-06-25T23:58:59.604288+00:00" }, { "type": "file-sha256", "sha256": "b3d1bcd1f1b31cdf0b512001d257de143549dc7a8b955f0539fb9ab987de3dd2", "family": "IRC Botnet Loader", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-05-26T06:24:53.642592+00:00", "last_seen": "2026-05-26T06:24:53.642592+00:00" }, { "type": "file-sha256", "sha256": "b1b8308d882329d9d10fed76e51cbdcba10a899abeeda81cda4764f61a4804d1", "family": "IRC botnet dropper", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-08-11T02:43:17.233126+00:00", "last_seen": "2026-08-20T06:32:20.528159+00:00" }, { "type": "file-sha256", "sha256": "a34ba470bf2876fd6808f5efb011777d669a65a34546bfa0fe3fec2f869ee493", "family": "Kaiten", "severity": 100, "attack": [ "T1037", "T1071", "T1078.001", "T1098", "T1098.004", "T1222", "T1489", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-08-30T09:59:24.964940+00:00", "last_seen": "2026-08-30T09:59:24.964940+00:00" }, { "type": "file-sha256", "sha256": "28536204a1922034ce95fb20c72d13eefc867cf353136f029c5aa3d6c973e077", "family": "XMRig", "severity": 70, "attack": [ "T1105", "T1496", "T1562.001", "T1584.002" ], "cves": [], "first_seen": "2026-10-06T17:32:21.417640+00:00", "last_seen": "2026-10-06T17:40:15.969471+00:00" }, { "type": "file-sha256", "sha256": "bf5fab6173946184299c8c6f40abcc916ae4657913d70104b5fb22a1f6abe413", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-08T03:40:15.364630+00:00", "last_seen": "2026-04-08T03:40:15.364630+00:00" }, { "type": "file-sha256", "sha256": "0291de841b47fe19557c2c999ae131cd571eb61782a109b9ef5b4a4944b6e76d", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-18T06:57:21.191159+00:00", "last_seen": "2026-08-18T06:57:21.191159+00:00" }, { "type": "file-sha256", "sha256": "041de4f1f393265f6070a00b700e7c20e9b915f6537f7b345f73b8d46aad2130", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-06T00:05:06.532662+00:00", "last_seen": "2026-09-06T00:05:06.532662+00:00" }, { "type": "file-sha256", "sha256": "04f5dd0e8c1bfdc778babfcf0897d77e9fad9f4a9b1183014e018de8cae4a42a", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-05T05:29:35.113683+00:00", "last_seen": "2026-08-05T05:29:35.113683+00:00" }, { "type": "file-sha256", "sha256": "0534c5c6d40ecb7b01e6e3844ffdd350cdc374cc8f0b265fe7b524f83c4a62a3", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-19T11:51:30.562581+00:00", "last_seen": "2026-09-19T11:51:30.562581+00:00" }, { "type": "file-sha256", "sha256": "059b25e849cd288ab86bed964cdf3a1254bdec4a4695bf95df813be6efde7dbf", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-08T06:13:01.880860+00:00", "last_seen": "2026-09-08T06:13:01.880860+00:00" }, { "type": "file-sha256", "sha256": "05d563ca4dd86807cd5e20f4678d30ee71644137ffac807f2f5a6917fa9b78ec", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-14T03:58:42.199147+00:00", "last_seen": "2026-08-14T03:58:42.199147+00:00" }, { "type": "file-sha256", "sha256": "094d2147548839ba5ed36d884983aaf14bd7ae650095dec96a1cf537d3b23b48", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-10-17T12:10:22.342769+00:00", "last_seen": "2026-10-17T12:10:22.342769+00:00" }, { "type": "file-sha256", "sha256": "0c59b7fd5968d1d24685f42d8ffc4810e92bf52593323aa48c818e4bc4c72b33", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-26T20:38:55.605521+00:00", "last_seen": "2026-07-26T20:38:55.605521+00:00" }, { "type": "file-sha256", "sha256": "0ceea9dadfacd6da2935932c00d669624fa19a40762e34bb3b90ac85caa324c4", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-31T09:41:52.202071+00:00", "last_seen": "2026-07-31T09:41:52.202071+00:00" }, { "type": "file-sha256", "sha256": "1923d2634fc1ddc43307c471ceb74533e029f9fa81323c86a49320e96306d9cb", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-20T23:15:13.475006+00:00", "last_seen": "2026-07-20T23:15:13.475006+00:00" }, { "type": "file-sha256", "sha256": "1aba4cbc9df35fac320f09c7507671648808d4ba632e6026f2f04a6384687dfd", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-26T06:26:48.341039+00:00", "last_seen": "2026-04-26T06:26:48.341039+00:00" }, { "type": "file-sha256", "sha256": "1eab50d219165ead29776b741bd263ad725e9cf2bbc3bbc810a0583f0bd1364f", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-08T19:36:06.797598+00:00", "last_seen": "2026-08-08T19:36:06.797598+00:00" }, { "type": "file-sha256", "sha256": "213e254beea6489dfd774d8e7dac3d4651565da1317a48e8d710c38ece10c7ee", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-16T15:45:32.571447+00:00", "last_seen": "2026-04-16T15:45:32.571447+00:00" }, { "type": "file-sha256", "sha256": "23b2d08a1e983d5419f26263494c3f356f344ac5c52fb967c1e6c6f1bbfd64c0", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-07T21:45:25.388209+00:00", "last_seen": "2026-07-07T21:45:25.388209+00:00" }, { "type": "file-sha256", "sha256": "29948c2e322b68dabbfafaac2593fa252c7d65b66b0d139a2397f327ad73d14e", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-07T20:48:50.626207+00:00", "last_seen": "2026-08-07T20:48:50.626207+00:00" }, { "type": "file-sha256", "sha256": "29fa93bbeae684352dd1dac335cb1ac7c9ba82bf862782a38a25514db8a20f73", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-05T03:29:18.600165+00:00", "last_seen": "2026-08-05T03:29:18.600165+00:00" }, { "type": "file-sha256", "sha256": "2a39d592018600e4b3db2caed6cdaa8c651d3dacbebf8ac1f0960e493843c435", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-27T13:51:49.416734+00:00", "last_seen": "2026-03-27T13:51:49.416734+00:00" }, { "type": "file-sha256", "sha256": "2b32bfcb42ea3283cf430c918e73730667fb434a4a2713283e63f44ebcadce36", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-10-15T04:54:04.976141+00:00", "last_seen": "2026-10-15T04:54:04.976141+00:00" }, { "type": "file-sha256", "sha256": "3474e95e102353c50c7bc0241a8e9ed6a17fa9eba072a24628c4cbb08b8ff64b", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-15T15:05:51.685775+00:00", "last_seen": "2026-07-15T15:05:51.685775+00:00" }, { "type": "file-sha256", "sha256": "3c5ffe548ea93622d11b67eead48d50f9ee39b09e1e813747883d1528569ffd1", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-21T21:01:53.048638+00:00", "last_seen": "2026-08-21T21:01:53.048638+00:00" }, { "type": "file-sha256", "sha256": "3d594ae09c50f0a63a8b213b6bbdf390f34ddd83900f1e0a9053e17fa20fd643", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-31T01:43:05.678169+00:00", "last_seen": "2026-03-31T01:43:05.678169+00:00" }, { "type": "file-sha256", "sha256": "3e90918b64c196fb7c0d501a3c1e4d4223d63b823d5fd5abd76b535958553fa7", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-02T07:50:14.765602+00:00", "last_seen": "2026-08-02T07:50:14.765602+00:00" }, { "type": "file-sha256", "sha256": "3f711f010ee63dd3a089cff847c5443a0bdd5d63c49e956e4d3bc5cb922f9462", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-11T23:38:51.991275+00:00", "last_seen": "2026-04-11T23:38:51.991275+00:00" }, { "type": "file-sha256", "sha256": "41bef8b5f87c62963cdbbd6b6c5c809375d2f5338138bbcc6220ed8e253f2eee", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-29T21:49:05.512408+00:00", "last_seen": "2026-03-29T21:49:05.512408+00:00" }, { "type": "file-sha256", "sha256": "4757f0ad27bc4a13d3c9c50645359a19e6658962f864c4c580323e32824d33c6", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-10-13T03:37:29.994009+00:00", "last_seen": "2026-10-13T03:37:29.994009+00:00" }, { "type": "file-sha256", "sha256": "4ee2c3a3b207ac66b42c249b2eb365525595baabf0467d0a07c8e20687b5ef0d", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-31T14:51:25.279130+00:00", "last_seen": "2026-03-31T14:51:25.279130+00:00" }, { "type": "file-sha256", "sha256": "50f93419c211c6dcb2ecc0c40761a33397fe1b0dcd9271090fcc10f57735ad2b", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-05T05:01:51.174673+00:00", "last_seen": "2026-08-05T05:01:51.174673+00:00" }, { "type": "file-sha256", "sha256": "528c0896f3289a8c5f05070cc5f460fe91a38e7144b1b6ba99b592ccf7b35a5d", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-01T18:06:44.155474+00:00", "last_seen": "2026-09-01T18:06:44.155474+00:00" }, { "type": "file-sha256", "sha256": "545660c74c9e342c23e17c32824d39d3f94647c543ac2e4c2433387bf62a5537", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-06T15:56:37.091302+00:00", "last_seen": "2026-10-13T00:03:16.431842+00:00" }, { "type": "file-sha256", "sha256": "587febf2da8d76b9994f5747170fce9d7d204f45867f1617fc8c65156a0c962e", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-19T05:04:54.725648+00:00", "last_seen": "2026-07-19T05:04:54.725648+00:00" }, { "type": "file-sha256", "sha256": "5c307e3667dae2acc74b57b3d5fc37f7cd9ca65f296e9740e5fe25b7ee3e6686", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-05T22:24:47.295633+00:00", "last_seen": "2026-07-05T22:24:47.295633+00:00" }, { "type": "file-sha256", "sha256": "5e21f3eb4a63f6a468835123bcc91daa6847bd838baf6bcf42a86080edcea9d4", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-18T21:15:14.415121+00:00", "last_seen": "2026-09-18T21:15:14.415121+00:00" }, { "type": "file-sha256", "sha256": "66f8f315000fe6a2a2e09fba08a867c60f4d330099ab2e94f7bdcb0f0c869377", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-19T15:52:09.308567+00:00", "last_seen": "2026-08-19T15:52:09.308567+00:00" }, { "type": "file-sha256", "sha256": "6f176ce2dba60eed990a8babacbb1cc99046ac605c32d73e74d6f6edd7dc2f23", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-10T04:07:53.642268+00:00", "last_seen": "2026-09-10T04:07:53.642268+00:00" }, { "type": "file-sha256", "sha256": "7398af011a33b43c81c8ccc4e1719c72a0d5c3ba24a81e29ab7294ef72c61d6f", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-01T16:26:50.060763+00:00", "last_seen": "2026-07-01T16:26:50.060763+00:00" }, { "type": "file-sha256", "sha256": "759914f35910b1cd0c241c41b4d22f5ff2e5398ac9b1ff2e32b7d9c12f880247", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-01T14:13:40.913032+00:00", "last_seen": "2026-07-01T14:13:40.913032+00:00" }, { "type": "file-sha256", "sha256": "769d295254984b910120e073bc7cdafa15a1c1310d513a1c2924c7a21d332db3", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-09T23:59:52.350111+00:00", "last_seen": "2026-04-09T23:59:52.350111+00:00" }, { "type": "file-sha256", "sha256": "76f4cff23b97b5cc222d0183a9ece353a5a36cfad2e722c6a7e00f47bf3137f0", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-11T22:33:14.555073+00:00", "last_seen": "2026-07-11T22:33:14.555073+00:00" }, { "type": "file-sha256", "sha256": "771815d8b0a83a098022bfdd17e4a7791682e0b9dbc285dd87fdfd0df2d409f5", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-13T02:23:15.916096+00:00", "last_seen": "2026-09-27T06:08:47.050422+00:00" }, { "type": "file-sha256", "sha256": "779abd34660f74072b0da4593db8e4639ce1c920ce394ca613dd85f94fc4019b", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-16T16:54:13.970803+00:00", "last_seen": "2026-07-16T16:54:13.970803+00:00" }, { "type": "file-sha256", "sha256": "78ca668d0b80aa116a399b7cb3677470fcbae9b193e312979a0cc995ebc0253a", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-04T11:32:10.595215+00:00", "last_seen": "2026-04-04T11:32:10.595215+00:00" }, { "type": "file-sha256", "sha256": "7b1a94c7e5dc71a25b5fd7992793977ac034c3279fb4b30ba834597cda33e41a", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-23T15:32:58.790530+00:00", "last_seen": "2026-07-23T15:32:58.790530+00:00" }, { "type": "file-sha256", "sha256": "7df8b09f2a8931e6d85905e9a9d67878688c5b0ec5e450704e000ec291487854", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-04-25T15:32:43.363274+00:00", "last_seen": "2026-04-25T15:32:43.363274+00:00" }, { "type": "file-sha256", "sha256": "7df9c2eae5029ca59fa58c5c9937fbf94380cef03cb9f38a5c71c44c3f39ad6f", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-13T03:14:47.405850+00:00", "last_seen": "2026-07-13T03:14:47.405850+00:00" }, { "type": "file-sha256", "sha256": "882e93fd3b383afe1c21cf64240d5137a48ddc6ac08f3b1cbd3e7246a559ed48", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-13T13:50:50.777533+00:00", "last_seen": "2026-08-13T13:50:50.777533+00:00" }, { "type": "file-sha256", "sha256": "8c0401aa06cf09bc7c95530ad019c96b3941dfb922782459806d5330fd6a1ff0", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-26T18:15:37.592348+00:00", "last_seen": "2026-03-26T18:15:37.592348+00:00" }, { "type": "file-sha256", "sha256": "8f2bf0926f75541184a1fad8b31a9442f801cf422dc1762c1a95ca2c2d846880", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-10-22T08:36:15.131767+00:00", "last_seen": "2026-10-22T08:36:15.131767+00:00" }, { "type": "file-sha256", "sha256": "923cb8d84e0bf45def36878ff5d6b80144610a708df24946659e29af727b71c8", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-01T00:30:42.630956+00:00", "last_seen": "2026-08-01T00:30:42.630956+00:00" }, { "type": "file-sha256", "sha256": "94f2e4d8d4436874785cd14e6e6d403507b8750852f7f2040352069a75da4c00", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-30T22:27:09.821015+00:00", "last_seen": "2026-10-24T16:44:37.865804+00:00" }, { "type": "file-sha256", "sha256": "956603daca538d141f14585bbc939377ca9f87c271809cd9c355573315fcf842", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-08T17:17:36.238760+00:00", "last_seen": "2026-08-08T17:17:36.238760+00:00" }, { "type": "file-sha256", "sha256": "9701ae7249aa394624bf33096e3f5dd2be0bb778debba3364f5277a50874cc31", "family": "Gafgyt", "severity": 65, "attack": [ "T1071", "T1562.001" ], "cves": [], "first_seen": "2026-10-06T17:32:21.262817+00:00", "last_seen": "2026-10-06T17:39:55.777804+00:00" }, { "type": "file-sha256", "sha256": "9760eafe2549ca6cba6f13620c8836942a20cf266259981448dc697876e89532", "family": "Gafgyt", "severity": 65, "attack": [], "cves": [], "first_seen": "2026-10-04T21:43:32.911244+00:00", "last_seen": "2026-10-04T21:43:32.911244+00:00" }, { "type": "file-sha256", "sha256": "9c91546bb4612e0a728d7f336fd8e18c515982e19f7e886f38bc53808b9ce7d7", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-28T01:11:24.234863+00:00", "last_seen": "2026-07-28T01:11:24.234863+00:00" }, { "type": "file-sha256", "sha256": "9db517b72b5e036b0949792b6d4b121a18862c36fa292effc6bbe404a8a66830", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-10-20T09:55:28.099931+00:00", "last_seen": "2026-10-20T09:55:28.099931+00:00" }, { "type": "file-sha256", "sha256": "9f50ff1eb3f4d67a685791f56e38a9ec1d7368b1f16e42b603857672a3f448cf", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-06-29T04:26:40.225662+00:00", "last_seen": "2026-06-29T04:26:40.225662+00:00" }, { "type": "file-sha256", "sha256": "9f6fa0544c67bd2d3c59f031c2d9ba107312772aaa7852ddb6cb6d9e94bbeb2a", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-04T04:02:16.981587+00:00", "last_seen": "2026-08-04T04:02:16.981587+00:00" }, { "type": "file-sha256", "sha256": "a2babc42eb2b0d046031c60393187f56b88bcd3d086559ce2b45253d9de6b3e2", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-24T22:30:14.220119+00:00", "last_seen": "2026-09-24T22:30:14.220119+00:00" }, { "type": "file-sha256", "sha256": "a63ef74b52848de6fe2db8947d46cf45ce9ab08d413da719dedb826a78257c33", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-13T14:15:27.866194+00:00", "last_seen": "2026-07-13T14:15:27.866194+00:00" }, { "type": "file-sha256", "sha256": "aa61cd81aa7a31d87727827b667ceefc3a32a9f77c686cfe6d74098aee79a50e", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-18T18:06:25.414491+00:00", "last_seen": "2026-09-18T18:06:25.414491+00:00" }, { "type": "file-sha256", "sha256": "ae50e78ef63519e35ef6eec42167023b2ff8f0b7fbf73ff6dd58130fa378f0fb", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-19T07:42:31.031553+00:00", "last_seen": "2026-07-19T07:42:31.031553+00:00" }, { "type": "file-sha256", "sha256": "bcaec119ca3407ed73a8d862b37c294a9bc6506e291c221fe4ef602fb2b84b4d", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-14T23:29:27.771766+00:00", "last_seen": "2026-09-14T23:29:27.771766+00:00" }, { "type": "file-sha256", "sha256": "0094c9465c7e996fad0b14db7e2b23132e8f1e114b22c98e0e265122a7507822", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-03-27T04:39:22.098098+00:00", "last_seen": "2026-07-13T09:53:35.979828+00:00" }, { "type": "file-sha256", "sha256": "c81b72a01d7d2a0eaa25101b6d24cf73128b4fd545a59817c0f2373087162538", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-07T14:41:29.290128+00:00", "last_seen": "2026-07-07T14:41:29.290128+00:00" }, { "type": "file-sha256", "sha256": "cec096e081f93f08c4686e57ed50d3ed5d305dacb1bb963d6bbbd39ac9376b87", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-18T06:40:02.548416+00:00", "last_seen": "2026-07-18T06:40:02.548416+00:00" }, { "type": "file-sha256", "sha256": "d0c1106cc5089220dfc7014d699bfc1b86104baeb8378fb58d305ccc3e43f2c0", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-27T08:16:02.831620+00:00", "last_seen": "2026-08-27T08:16:02.831620+00:00" }, { "type": "file-sha256", "sha256": "d3be2f32d31d5797b6ed5f69b8ad71550592de0b945a11ff4ecd84f6d4abcc99", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-31T20:56:49.705158+00:00", "last_seen": "2026-08-31T20:56:49.705158+00:00" }, { "type": "file-sha256", "sha256": "df2e5339126b156c33f0c6596b5460c9dd488b98f4b98ad7029117b4c22839cf", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-07T02:02:35.695372+00:00", "last_seen": "2026-08-07T02:02:35.695372+00:00" }, { "type": "file-sha256", "sha256": "df46713c459edb811814c12babe940b480e945a9a0ab4906d165301bcf70c6cc", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-03T19:05:55.843928+00:00", "last_seen": "2026-09-03T19:05:55.843928+00:00" }, { "type": "file-sha256", "sha256": "e3f277c384e51304b71ba0b5b810ba989b4d42eccab82def6d91e538d08d42db", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-10-07T03:56:11.048025+00:00", "last_seen": "2026-10-07T03:56:11.048025+00:00" }, { "type": "file-sha256", "sha256": "e798225b2d6c075e9a29e11bc6491749ebdfea749381b5651a2b468167a87a61", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-18T16:47:21.528578+00:00", "last_seen": "2026-07-18T16:47:21.528578+00:00" }, { "type": "file-sha256", "sha256": "e91b36bc7495acbbeebfda1c6c3b17e8ea4bbcb42e85137f814377f482fa9fc6", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-05-16T11:55:54.079142+00:00", "last_seen": "2026-05-16T11:55:54.079142+00:00" }, { "type": "file-sha256", "sha256": "f783a5d7bd7825854b33f231a70a803a59d29b27c0995ec8cee20cad7438a6af", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-08-27T06:56:55.878442+00:00", "last_seen": "2026-08-27T06:56:55.878442+00:00" }, { "type": "file-sha256", "sha256": "f90eb51dfc4fcf9673875c9d044ffee51adf74108538949408325ec8ca33ea74", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-29T18:06:02.841141+00:00", "last_seen": "2026-07-29T18:06:02.841141+00:00" }, { "type": "file-sha256", "sha256": "fc0185a577b10f2f7533d396bf424be83bb5ab5716a4403f721cd688bb82b9db", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-11T00:19:34.106746+00:00", "last_seen": "2026-09-11T00:19:34.106746+00:00" }, { "type": "file-sha256", "sha256": "ff5b4879a98c33c464a16defb7e96776af7698c3bdefc6a282f2f086fd7f6e31", "family": "XMRig", "severity": 65, "attack": [ "T1078.001", "T1222", "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-09-14T15:08:01.937742+00:00", "last_seen": "2026-09-14T15:08:01.937742+00:00" }, { "type": "file-sha256", "sha256": "1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d", "family": "RedTail", "severity": 60, "attack": [ "T1222" ], "cves": [], "first_seen": "2026-08-10T23:56:21.459854+00:00", "last_seen": "2026-10-19T11:36:12.004830+00:00" }, { "type": "file-sha256", "sha256": "197c74408e15bd1168105f564f96aace4fd4819961b724630bf5a6be4878daf8", "family": "XMRig", "severity": 60, "attack": [ "T1053", "T1543", "T1562.001" ], "cves": [], "first_seen": "2026-07-09T05:54:03.234093+00:00", "last_seen": "2026-08-08T15:46:50.019767+00:00" }, { "type": "file-sha256", "sha256": "8c0da2c903eaf8aeeaef90db5ff708313ff807673da59e70edf2a2569d77b332", "family": "Linux dropper/downloader", "severity": 55, "attack": [ "T1071", "T1105", "T1543" ], "cves": [], "first_seen": "2026-07-26T23:29:22.730230+00:00", "last_seen": "2026-07-26T23:29:22.784602+00:00" }, { "type": "file-sha256", "sha256": "b424f481b0c3460646d2a3460da3ec43dcfe596b26f40bb683c5ef4d7c02b4ea", "family": "AWS-Credential-Harvester", "severity": 55, "attack": [ "T1053", "T1105", "T1543" ], "cves": [], "first_seen": "2026-10-05T02:14:59.053709+00:00", "last_seen": "2026-10-05T02:14:59.053709+00:00" }, { "type": "file-sha256", "sha256": "44fcd7a6a61dd418b64fd2fa3e0048d139740bf74a77d261a6900e24609e83f6", "family": "Linux Dropper", "severity": 55, "attack": [ "T1071", "T1105", "T1543" ], "cves": [], "first_seen": "2026-07-26T23:29:22.838874+00:00", "last_seen": "2026-07-26T23:29:22.893324+00:00" }, { "type": "file-sha256", "sha256": "d1272c36897a7a76a35c07e47815c05a86b15138854438c104790e94d3e286b6", "family": "TFTP Downloader", "severity": 55, "attack": [ "T1071", "T1105", "T1543" ], "cves": [], "first_seen": "2026-07-26T23:29:22.620738+00:00", "last_seen": "2026-07-26T23:29:22.675645+00:00" }, { "type": "file-sha256", "sha256": "ca68240537ee2f4177ae7bf1ef0281052d9b720d05f04f9ff43b711d85d77366", "family": "XMRig", "severity": 55, "attack": [ "T1053", "T1496" ], "cves": [], "first_seen": "2026-10-04T17:58:11.822795+00:00", "last_seen": "2026-10-04T17:58:11.822795+00:00" }, { "type": "file-sha256", "sha256": "6ef41d3251793644f01d1a20990882ebf15abfb564a5e4001b4aca76242013dd", "family": "File Downloader/Exfiltrator", "severity": 55, "attack": [ "T1071", "T1105", "T1543" ], "cves": [], "first_seen": "2026-07-26T23:29:22.947128+00:00", "last_seen": "2026-07-26T23:29:23.001806+00:00" }, { "type": "file-sha256", "sha256": "d90ef6506879ed03d25fc96b4166cd60158286ba733a7af41d20f7a8e7019fb3", "family": "AWS-Credential-Harvester", "severity": 55, "attack": [ "T1053", "T1105" ], "cves": [], "first_seen": "2026-10-05T00:04:39.323719+00:00", "last_seen": "2026-10-05T00:04:39.323719+00:00" }, { "type": "file-sha256", "sha256": "d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c", "family": "Whisper", "severity": 45, "attack": [ "T1105", "T1222" ], "cves": [], "first_seen": "2026-06-13T12:05:36.705836+00:00", "last_seen": "2026-06-13T12:05:36.705836+00:00" }, { "type": "file-sha256", "sha256": "f29c23e3ce0a393d9cd5927b4873e8b9a4a8800e4a1270abfd8f279ae4041729", "family": "C2 downloader loader", "severity": 45, "attack": [ "T1105", "T1222" ], "cves": [], "first_seen": "2026-07-26T23:29:22.416252+00:00", "last_seen": "2026-07-26T23:29:22.467279+00:00" }, { "type": "file-sha256", "sha256": "4afb522ad9bb6998e218b55b2b6014d6558a924e1272078d782d472b541894fc", "family": "Multi-architecture dropper", "severity": 45, "attack": [ "T1105", "T1222" ], "cves": [], "first_seen": "2026-07-23T18:00:51.354800+00:00", "last_seen": "2026-07-23T18:00:51.405938+00:00" }, { "type": "file-sha256", "sha256": "1c847d3bd3ef4bf7e21a7091f1479e0e2ca432585ebea996653845b9adfb150e", "family": "XMRig", "severity": 45, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-10-17T20:03:27.661434+00:00", "last_seen": "2026-10-17T20:03:27.661434+00:00" }, { "type": "file-sha256", "sha256": "48b3ad1c96303299ab19426b0ba755d35fb4b24e963cf42cf59050278d8a3e1b", "family": "XMRig", "severity": 45, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-10-04T17:58:11.338636+00:00", "last_seen": "2026-10-04T22:01:38.921993+00:00" }, { "type": "file-sha256", "sha256": "7b24ea4eaa0aaaf1c21b44f8e2cdd00010c4cf7cd8f8b3f24dc7847687744eaf", "family": "XMRig", "severity": 45, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-08-08T09:39:37.929768+00:00", "last_seen": "2026-08-08T09:39:37.929768+00:00" }, { "type": "file-sha256", "sha256": "3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892", "family": "XMRig", "severity": 45, "attack": [ "T1053", "T1543" ], "cves": [], "first_seen": "2026-08-10T23:56:21.388186+00:00", "last_seen": "2026-10-19T11:36:11.946322+00:00" }, { "type": "file-sha256", "sha256": "c0523063abe84c4064e3fad4f5503f9a7ea500420ddf909ef4ae1979da45cc15", "family": "Aterna", "severity": 45, "attack": [ "T1105", "T1222" ], "cves": [], "first_seen": "2026-07-30T00:15:54.349068+00:00", "last_seen": "2026-07-30T00:15:54.401707+00:00" }, { "type": "file-sha256", "sha256": "853f57f10f84ee3693b67fd18dc67346fa6ad735f8950ecf33443600322c874b", "family": "Cross-compiled binary loader", "severity": 45, "attack": [ "T1105", "T1222" ], "cves": [], "first_seen": "2026-03-27T09:16:42.471639+00:00", "last_seen": "2026-03-27T09:16:42.677227+00:00" }, { "type": "file-sha256", "sha256": "7978a302742ed28114a228e47998bfe12b6d437baa946808f3250821e8886878", "family": "systemd persistence loader", "severity": 40, "attack": [ "T1543", "T1584.002" ], "cves": [], "first_seen": "2026-07-23T18:00:51.549779+00:00", "last_seen": "2026-07-23T18:00:51.608392+00:00" }, { "type": "file-sha256", "sha256": "a381bc599339e19ce1aac8cb83979581ece3f9ab93ce01e78d3dde0c44b6bc5d", "family": "Systemd Persistence Dropper", "severity": 40, "attack": [ "T1543", "T1584.002" ], "cves": [], "first_seen": "2026-07-23T18:00:51.656719+00:00", "last_seen": "2026-07-23T18:00:51.708648+00:00" }, { "type": "file-sha256", "sha256": "c69cb1024bc86e9e2bb328f0b934cd65c806943a18736d50de2696266b2ec69c", "family": "Systemd Persistence ELF", "severity": 40, "attack": [ "T1543", "T1584.002" ], "cves": [], "first_seen": "2026-07-23T18:00:51.795667+00:00", "last_seen": "2026-07-23T18:00:51.885151+00:00" }, { "type": "file-sha256", "sha256": "52c9fa27b5b1b1655447f1b024817f666ab1aadbebda540e63cab98d119bd0c9", "family": "systemd persistence implant", "severity": 40, "attack": [ "T1543", "T1584.002" ], "cves": [], "first_seen": "2026-07-23T18:00:51.939481+00:00", "last_seen": "2026-07-23T18:00:51.986507+00:00" }, { "type": "file-sha256", "sha256": "f459320dfbe7c408641e206196152f5a7c6216a136103e29cfb7ff1027ebe3df", "family": "Cron persistence backdoor", "severity": 40, "attack": [ "T1053", "T1543", "T1584.002" ], "cves": [], "first_seen": "2026-09-25T09:01:02.075083+00:00", "last_seen": "2026-09-25T09:01:02.075083+00:00" }, { "type": "file-sha256", "sha256": "bd82d168b0a3c1099f3f2e59694e0f6ffb9c46eff9a36c3d895d26400c5d3b03", "family": "Credential Harvester", "severity": 35, "attack": [ "T1053", "T1543" ], "cves": [], "first_seen": "2026-10-04T23:18:49.245533+00:00", "last_seen": "2026-10-04T23:18:49.245533+00:00" }, { "type": "file-sha256", "sha256": "0c437b5fa8e3e4749bf9fda7337086f1d1f02c591e63bc14ddc753072f585ebf", "family": "Linux Password Backdoor", "severity": 35, "attack": [ "T1098" ], "cves": [], "first_seen": "2026-10-04T21:43:42.790329+00:00", "last_seen": "2026-10-04T21:43:42.790329+00:00" }, { "type": "file-sha256", "sha256": "a9f270499ffdfb6bc41af57f362a4114944025ebec2e46f4f45afea5f28f41f6", "family": "SSH Key Backdoor Dropper", "severity": 35, "attack": [ "T1098", "T1098.004" ], "cves": [], "first_seen": "2026-09-27T09:21:35.578619+00:00", "last_seen": "2026-09-27T09:21:35.734162+00:00" }, { "type": "file-sha256", "sha256": "3497679f95a7532c2d324e8886f7d433ca4a4f9e2ad3bd5e3826b347fecb6e95", "family": "DirtyC", "severity": 35, "attack": [ "T1098" ], "cves": [], "first_seen": "2026-10-04T21:43:52.368790+00:00", "last_seen": "2026-10-04T21:43:52.368790+00:00" }, { "type": "file-sha256", "sha256": "4ea546ef00c8b2c6efcba2cf03d73171c2d62e807b79865c1d83c3de92171624", "family": "Credential Harvester and Persistence", "severity": 35, "attack": [ "T1053", "T1543" ], "cves": [], "first_seen": "2026-09-24T21:11:01.200935+00:00", "last_seen": "2026-09-24T21:11:01.227531+00:00" }, { "type": "file-sha256", "sha256": "5620bc05251977d7478e460317b810a7444442eee08cd341982ed8eb0f813ff6", "family": "API Key Harvester", "severity": 35, "attack": [ "T1053", "T1543" ], "cves": [], "first_seen": "2026-09-24T20:39:21.961635+00:00", "last_seen": "2026-09-27T07:22:37.599263+00:00" }, { "type": "file-sha256", "sha256": "ce9262fcf7b033847157e77a98f666b2fed8be7db7276e90dbddf1bd41ce9dac", "family": "API-Key Harvester", "severity": 35, "attack": [ "T1053", "T1543" ], "cves": [], "first_seen": "2026-09-27T08:50:33.414040+00:00", "last_seen": "2026-09-27T08:50:33.554239+00:00" }, { "type": "file-sha256", "sha256": "3625d068896953595e75df328676a08bc071977ac1ff95d44b745bbcb7018c6f", "family": "RedTail", "severity": 25, "attack": [ "T1496", "T1584.002" ], "cves": [], "first_seen": "2026-07-09T05:54:03.240108+00:00", "last_seen": "2026-07-09T05:54:03.240108+00:00" }, { "type": "file-sha256", "sha256": "783adb7ad6b16fe9818f3e6d48b937c3ca1994ef24e50865282eeedeab7e0d59", "family": "RedTail", "severity": 25, "attack": [ "T1222" ], "cves": [], "first_seen": "2026-07-09T05:54:03.263844+00:00", "last_seen": "2026-07-09T05:54:03.263844+00:00" }, { "type": "file-sha256", "sha256": "31d4181843b1ed10a7e7cb3f108f6d6c50a7a4452ee52ddacabe8ca77260615e", "family": "RedTail", "severity": 25, "attack": [ "T1222" ], "cves": [], "first_seen": "2026-07-19T08:50:02.517191+00:00", "last_seen": "2026-08-08T15:46:50.060544+00:00" }, { "type": "file-sha256", "sha256": "f2ca2b2051c2a98e23b80aab601369474006f6a6dd1dfb8f212f51a726b23dcc", "family": "SSH-key backdoor dropper", "severity": 25, "attack": [ "T1562.001" ], "cves": [], "first_seen": "2026-06-08T22:22:47.054312+00:00", "last_seen": "2026-06-08T22:22:47.054312+00:00" }, { "type": "file-sha256", "sha256": "d5a3e198f38695a46b8941ac22ad9d0e097e7d001bd62b0e173e1bb0ec100c4e", "family": "Credential Harvester", "severity": 20, "attack": [ "T1105" ], "cves": [], "first_seen": "2026-10-06T13:46:20.268541+00:00", "last_seen": "2026-10-07T03:54:05.359049+00:00" }, { "type": "file-sha256", "sha256": "f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-31T01:19:20.398879+00:00", "last_seen": "2026-10-19T11:36:12.000390+00:00" }, { "type": "file-sha256", "sha256": "a485511f190cca50a45098bddd4f45f7bdeb8467f12cf726d1659fa3326aa5be", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-19T08:50:02.365462+00:00", "last_seen": "2026-07-19T08:50:02.365462+00:00" }, { "type": "file-sha256", "sha256": "a531f3e6224862abd00091c4955d535ace2bb886df53bdcd59c3a32b44c93629", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-19T08:50:02.514855+00:00", "last_seen": "2026-07-19T08:50:02.514855+00:00" }, { "type": "file-sha256", "sha256": "2a272bbaa1275f21835fd3258fb8032ccdc98348e6ccb9cf58acacd366340170", "family": "System Info Script", "severity": 20, "attack": [ "T1105" ], "cves": [], "first_seen": "2026-04-05T22:00:33.998928+00:00", "last_seen": "2026-04-05T22:14:07.592254+00:00" }, { "type": "file-sha256", "sha256": "f7a365217cee30786abd3117313585bd27dbd4177194775e9899ff252e6e1a34", "family": "Credential Harvester", "severity": 20, "attack": [ "T1105" ], "cves": [], "first_seen": "2026-10-08T23:24:52.832994+00:00", "last_seen": "2026-10-08T23:57:36.483060+00:00" }, { "type": "file-sha256", "sha256": "d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-31T01:19:20.356794+00:00", "last_seen": "2026-10-19T11:36:11.958080+00:00" }, { "type": "file-sha256", "sha256": "8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-31T01:19:20.382798+00:00", "last_seen": "2026-10-19T11:36:11.985635+00:00" }, { "type": "file-sha256", "sha256": "8ec920a35a7c6dd60e4aeb3b1ed09cd344f4c5191d4314a05ce72bf757377c86", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-19T08:50:02.256966+00:00", "last_seen": "2026-07-19T08:50:02.256966+00:00" }, { "type": "file-sha256", "sha256": "dbb7ebb960dc0d5a480f97ddde3a227a2d83fcaca7d37ae672e6a0a6785631e9", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-09T05:54:03.247032+00:00", "last_seen": "2026-07-09T05:54:03.247032+00:00" }, { "type": "file-sha256", "sha256": "f3a8ffee82d63d285245f66f82f7add5a056a20f4b339e8cdd218ffd3ac6314d", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-19T08:50:02.231994+00:00", "last_seen": "2026-07-19T08:50:02.231994+00:00" }, { "type": "file-sha256", "sha256": "048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-09T05:54:03.255168+00:00", "last_seen": "2026-07-09T05:54:03.255168+00:00" }, { "type": "file-sha256", "sha256": "d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-31T01:19:20.369830+00:00", "last_seen": "2026-10-19T11:36:11.971775+00:00" }, { "type": "file-sha256", "sha256": "785bde76337e4c6704fdf6bde5fa6d4dcb891e20c3b9dcfa931928de04caf6a9", "family": "AI-Infra Credential Harvester", "severity": 20, "attack": [ "T1105" ], "cves": [], "first_seen": "2026-10-05T14:13:40.431910+00:00", "last_seen": "2026-10-05T14:13:40.431910+00:00" }, { "type": "file-sha256", "sha256": "59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5", "family": "RedTail", "severity": 20, "attack": [ "T1496" ], "cves": [], "first_seen": "2026-07-09T05:54:03.263149+00:00", "last_seen": "2026-07-09T05:54:03.263149+00:00" }, { "type": "file-sha256", "sha256": "0667a1e8d964d4d8d8792e9b4a07df3dc2d2b1d55b38e8520111751189e0435e", "family": "AI-Credential Harvester", "severity": 20, "attack": [ "T1105" ], "cves": [], "first_seen": "2026-10-05T16:13:18.555045+00:00", "last_seen": "2026-10-05T16:13:18.555045+00:00" }, { "type": "file-sha256", "sha256": "d18ec4af8dad7495ed52dc0a59ede9a23fa66b3d87bb25d61ae6082d28fbef65", "family": "Linux privilege escalation probe", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-05T05:48:37.926728+00:00", "last_seen": "2026-10-05T05:48:37.926728+00:00" }, { "type": "file-sha256", "sha256": "e948036f1c3b3024a6864fa1c49332c80e1fd28484cf487233a50154ffe104f8", "family": "SSH-PAM backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-02T03:28:44.813426+00:00", "last_seen": "2026-10-23T14:52:42.218792+00:00" }, { "type": "file-sha256", "sha256": "ab7d80e73d8927b35942c4e5f69107d758c01991e1d9df48977e7d1463ce3c6d", "family": "Claude API Key Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-24T21:20:51.191949+00:00", "last_seen": "2026-09-24T21:20:51.221534+00:00" }, { "type": "file-sha256", "sha256": "e981d296a7034bc03a3a84185b5ac07d26afc01004f55cafadfaad1c42d70f40", "family": "RedTail", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-19T08:50:02.458796+00:00", "last_seen": "2026-07-19T08:50:02.458796+00:00" }, { "type": "file-sha256", "sha256": "ae8d459595257f2f22c9d1ff74c4fb8a91643fad7899b57556496716692b904e", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-12T14:24:10.642206+00:00", "last_seen": "2026-10-26T01:18:53.438245+00:00" }, { "type": "file-sha256", "sha256": "b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-30T00:15:54.453322+00:00", "last_seen": "2026-07-30T00:15:54.453322+00:00" }, { "type": "file-sha256", "sha256": "12de77bef9500e41c76a2200bc6fa712e7e3fc188dfdd92a764a22c3421b7208", "family": "PAM session backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-24T20:30:44.530975+00:00", "last_seen": "2026-08-24T20:30:44.530975+00:00" }, { "type": "file-sha256", "sha256": "27d205dc183ea2fad0e55e10b206404be20908e39a74569ff99182d7326ed9c0", "family": "sshd", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-17T04:22:20.184731+00:00", "last_seen": "2026-10-17T04:22:20.184731+00:00" }, { "type": "file-sha256", "sha256": "0f6966bada6e20ae6a8631d066252ca1261f2122d064878e6b4c85e4d4a4e183", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-18T15:01:43.425535+00:00", "last_seen": "2026-10-18T15:01:43.425535+00:00" }, { "type": "file-sha256", "sha256": "87f623a1b5ea7f6c0ea107a71ce46d1943a846be4580a84d3eeb4a09740244f9", "family": "Audio-Video Enumerator", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-25T01:33:05.492117+00:00", "last_seen": "2026-09-25T01:33:05.518505+00:00" }, { "type": "file-sha256", "sha256": "0ee55ed93e39f63cdc64a6149d6e3f9c810c4139ac22a401e467dbe38e8ed671", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-04T17:58:12.845657+00:00", "last_seen": "2026-10-04T21:43:31.354929+00:00" }, { "type": "file-sha256", "sha256": "bb5e43be2a0e718aa8b4763063c1e022e987f7a2888919a96a7bf7181ed20040", "family": "LLM Credential Manager", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-27T12:05:32.518029+00:00", "last_seen": "2026-09-27T12:05:32.633559+00:00" }, { "type": "file-sha256", "sha256": "2c2cda78d5a2846a63a8a90aac3e948a9d1e1e614b0d3d3ad9c33962b365ba93", "family": "Apache 404 Error Page", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T17:32:21.571301+00:00", "last_seen": "2026-10-06T17:39:56.107564+00:00" }, { "type": "file-sha256", "sha256": "32b44db3980a94e1be989a4c5605cb2b3ed2db6cfa208943c70ae2a82d983291", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T17:32:20.915449+00:00", "last_seen": "2026-10-06T17:40:06.187421+00:00" }, { "type": "file-sha256", "sha256": "eac39306dc04bd54b3a8c5f4cf732ce0ee4fd2799287c7405992eb0b886761d7", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-10T17:57:20.134322+00:00", "last_seen": "2026-10-10T17:57:20.134322+00:00" }, { "type": "file-sha256", "sha256": "34834402d2029815ba3ace24fe452302d9d7ba925f31aab319e81b95a00e9a08", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-04T17:58:14.114209+00:00", "last_seen": "2026-10-04T17:58:14.114209+00:00" }, { "type": "file-sha256", "sha256": "f1743c85c03a153930f20798ad002acc377e1c32224a6633e45af272e08c9ea3", "family": "PAM session backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-23T20:03:51.052326+00:00", "last_seen": "2026-09-23T20:03:51.052326+00:00" }, { "type": "file-sha256", "sha256": "38ef0580d99fb1524c13f8dc4981fe2757deb290b29f947ebc24b4b359756f63", "family": "PAM session handler", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-02T05:02:32.834826+00:00", "last_seen": "2026-08-02T05:02:32.834826+00:00" }, { "type": "file-sha256", "sha256": "d16bffbd3ba31504aea1fc01e66e29ad5927830ea5e2cc49369e82a7c68ec5c0", "family": "PAM session manipulator", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-26T08:46:22.406005+00:00", "last_seen": "2026-07-26T08:46:22.406005+00:00" }, { "type": "file-sha256", "sha256": "d8e8a8598e17108e6500523799450ce17aacd8d71c553294915aa5dc943e773c", "family": "AI-Credential Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-07T13:15:11.282048+00:00", "last_seen": "2026-10-07T13:15:11.282048+00:00" }, { "type": "file-sha256", "sha256": "d7f98e379c400c13340781ccb65017c000330824ea26680866b9d3e43d641721", "family": "SSH-PAM session handler", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-10T01:22:42.808673+00:00", "last_seen": "2026-07-10T01:22:42.808673+00:00" }, { "type": "file-sha256", "sha256": "3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39", "family": "RedTail", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-31T01:19:20.390479+00:00", "last_seen": "2026-10-19T11:36:11.993040+00:00" }, { "type": "file-sha256", "sha256": "c50744c33f554b3b2fc6ac323cacdd0e0c193f2ea6356237f5f6be62105c4e83", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-06-01T17:10:49.828316+00:00", "last_seen": "2026-06-01T17:10:49.828316+00:00" }, { "type": "file-sha256", "sha256": "4028d35296a30d9acd62241e433a8b4668b4f93301b126fef9d65be0514bdcad", "family": "Linux System Enumeration Script", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-22T19:35:34.328183+00:00", "last_seen": "2026-10-26T16:38:14.973513+00:00" }, { "type": "file-sha256", "sha256": "c5f295148d67c0face77f285128fc99d9288a0d2085ea2315ee0db20fa5c82ae", "family": "API Key Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-25T11:34:52.397143+00:00", "last_seen": "2026-09-25T11:34:52.397143+00:00" }, { "type": "file-sha256", "sha256": "434b4bd4fa61e03e74cb82fbeaa2e75b80c0bfb42a7ef916a71375267cd6a5c2", "family": "SSH-Backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-23T01:38:07.501559+00:00", "last_seen": "2026-10-23T01:38:07.501559+00:00" }, { "type": "file-sha256", "sha256": "44dea45cce4361332160862381dd1b1f95300c94a6bd29db79cd50d534a85ac3", "family": "Mail Reconnaissance Script", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-26T12:44:25.094778+00:00", "last_seen": "2026-09-26T12:44:25.094778+00:00" }, { "type": "file-sha256", "sha256": "458f96a31679aa2b9a5cee7b5aa1ebff775773496fbdd1368b6e1c95e347afcb", "family": "Runtime monitoring tool", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-06-08T21:30:31.759480+00:00", "last_seen": "2026-06-08T21:30:31.759480+00:00" }, { "type": "file-sha256", "sha256": "466d83e0dbaba5e79cfe82e20fb71ff175704cb9b2e72e05cc4b89fbcb94697d", "family": "Network Metadata File", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-27T00:10:44.361731+00:00", "last_seen": "2026-04-27T00:13:08.281849+00:00" }, { "type": "file-sha256", "sha256": "4ab686e2cc774229d402ee8ebe5688c1650c3ef433f43fd87967c18885c8d01c", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T10:51:16.773440+00:00", "last_seen": "2026-10-20T15:47:54.969199+00:00" }, { "type": "file-sha256", "sha256": "72ce5b00ca4bfa0c18fcdf03a15e5391a85d81300783626598fe7e022e0ec538", "family": "PAM session manipulator", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-27T19:39:52.279444+00:00", "last_seen": "2026-03-27T19:39:52.279444+00:00" }, { "type": "file-sha256", "sha256": "f01cac66a63b3bfd7409e4bceef30973a813f6ed4e99958313657449b1c7490f", "family": "PAM credential manipulator", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-10T14:18:39.633860+00:00", "last_seen": "2026-07-10T14:18:39.633860+00:00" }, { "type": "file-sha256", "sha256": "c82a38204e0637418f3f6f086b62274118cf0101a8c4efaf27b1f60bf177145b", "family": "Runtime monitoring tool", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-06-08T21:40:07.111626+00:00", "last_seen": "2026-06-08T21:40:07.111626+00:00" }, { "type": "file-sha256", "sha256": "c88e1dacce96cafa2038f7433fc9e42e7b26714c36e98ed59c483360a4b7cb58", "family": "SSH-Backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T22:52:23.582392+00:00", "last_seen": "2026-10-06T22:52:23.582392+00:00" }, { "type": "file-sha256", "sha256": "776c0fccae481c384f5636903ce500fae22803cf8778ec9a029956bb85a68010", "family": "PAM session manipulator", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-31T21:30:35.416590+00:00", "last_seen": "2026-08-31T21:30:35.416590+00:00" }, { "type": "file-sha256", "sha256": "535760e630fb32e12ae10359225e219a98131afd47484bd64cd5c83b29940e29", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-06-01T03:38:48.650155+00:00", "last_seen": "2026-06-01T03:38:48.650155+00:00" }, { "type": "file-sha256", "sha256": "c9f53c5a7971ce9053edf75583484635154ad09b791cfde914775d49045b1328", "family": "PAM Session Backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-26T16:51:40.318291+00:00", "last_seen": "2026-08-26T16:51:40.318291+00:00" }, { "type": "file-sha256", "sha256": "768fa265ab49cb9a2486a04fd03c5ec31fe98111853387f8efd06396fb34af78", "family": "PAM Credential Stealer", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-06T22:38:03.763082+00:00", "last_seen": "2026-09-06T22:38:03.763082+00:00" }, { "type": "file-sha256", "sha256": "58189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f", "family": "Windows API dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-06-13T12:05:36.849129+00:00", "last_seen": "2026-06-13T12:05:37.152181+00:00" }, { "type": "file-sha256", "sha256": "58e686da107bb46a0b37f2f71197ebd32c8ee026227c1f27197e195836327386", "family": "PAM backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-22T20:54:18.446128+00:00", "last_seen": "2026-08-22T20:54:18.446128+00:00" }, { "type": "file-sha256", "sha256": "58ee0db432c51a3557874c96d9b2ab747daac75f8903adf30008d93726637ea0", "family": "Credential Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T14:51:40.988544+00:00", "last_seen": "2026-10-06T14:51:41.126092+00:00" }, { "type": "file-sha256", "sha256": "2701f44fcaf29bbec2178f3e9b896235fca2af92252b53faac93964b6403a42b", "family": "GPU-Info Collector", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-05T07:43:09.245976+00:00", "last_seen": "2026-10-05T07:43:09.245976+00:00" }, { "type": "file-sha256", "sha256": "5a0ad9c6e04897fff74fc9c0a2cabcd62115335c315d3c9b64c82641867f43c7", "family": "SSH backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-02T00:57:35.740867+00:00", "last_seen": "2026-08-02T00:57:35.740867+00:00" }, { "type": "file-sha256", "sha256": "765289f938cc2bd64c9778dbabe048afa8ac3277a150c940d2730c14d24687b5", "family": "sshd", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T09:29:25.479519+00:00", "last_seen": "2026-10-06T09:29:25.479519+00:00" }, { "type": "file-sha256", "sha256": "24ae8b955c30ea8049319e0ad55d68a600a7463612e7ee004fb3e0d67e6b5e78", "family": "Credential Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-05T05:46:59.671991+00:00", "last_seen": "2026-10-05T05:46:59.671991+00:00" }, { "type": "file-sha256", "sha256": "61313b582ba8fa8ba6a819fd4a960d51e7c92324efe8c0f5294c651f26223753", "family": "SSHD backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-22T06:01:14.922876+00:00", "last_seen": "2026-07-22T06:01:14.922876+00:00" }, { "type": "file-sha256", "sha256": "629db57b96d6e965401d866f895d86c542efe344b3d489630a6ec09d643add76", "family": "PAM backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-24T20:24:06.131479+00:00", "last_seen": "2026-03-24T20:24:06.131479+00:00" }, { "type": "file-sha256", "sha256": "649c259de02833af9fc8d3116effcd5fb0ec844b1050dafed8db388ff676057e", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-17T14:31:16.184349+00:00", "last_seen": "2026-08-17T14:31:16.184349+00:00" }, { "type": "file-sha256", "sha256": "cfd7ad5fd929fbdef0af698ee1f7f1624ed46109a50125f7ab39b14bd84dfcac", "family": "PAM session handler", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-04T20:40:15.178500+00:00", "last_seen": "2026-07-04T20:40:15.178500+00:00" }, { "type": "file-sha256", "sha256": "6869ce81729acda83597601eb7c89c0bdda23d41bd5fe6900256dfb389a9bf47", "family": "SSH-PAM backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-15T14:26:38.589606+00:00", "last_seen": "2026-09-15T14:26:38.589606+00:00" }, { "type": "file-sha256", "sha256": "2497a2129dce5ff56e3be1a5dee15ac237aedcbcf95fa817c8428447bc597c0e", "family": "SSH-related implant", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-04T02:27:23.069713+00:00", "last_seen": "2026-04-04T02:27:23.069713+00:00" }, { "type": "file-sha256", "sha256": "0db4656687a425c47d19000db866db52c7e415dbfaf6b5c651adcb9275ab23ca", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-12T14:24:10.643555+00:00", "last_seen": "2026-10-26T01:18:53.438968+00:00" }, { "type": "file-sha256", "sha256": "dd87db464677c38f49c12425517a96a175de3cb382caa8185deb44511d116d4a", "family": "API Token Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-24T23:41:01.298113+00:00", "last_seen": "2026-09-24T23:41:01.323771+00:00" }, { "type": "file-sha256", "sha256": "93f82a68b84fa9020d63812a37fca720944044e19a63dc65d67fb12b8d2d6479", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-04T21:43:52.845644+00:00", "last_seen": "2026-10-04T21:43:52.845644+00:00" }, { "type": "file-sha256", "sha256": "1a3e06d0fab452162cdd7f676decdc61848a4809c613a8e786cc397a21e11484", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-16T20:41:03.132056+00:00", "last_seen": "2026-08-16T20:41:03.132056+00:00" }, { "type": "file-sha256", "sha256": "9665a120423fc3a866847375402fac4dcd7fa4efa051e5b6a702ac2497883ef2", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-24T03:05:37.427849+00:00", "last_seen": "2026-03-24T03:05:37.427849+00:00" }, { "type": "file-sha256", "sha256": "969f7e385a26f1dd429ef52b65f9604bc109d00c31f2a7624ed44c50060f4ed9", "family": "Generic ELF Dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-26T08:37:13.671532+00:00", "last_seen": "2026-10-26T08:37:13.671532+00:00" }, { "type": "file-sha256", "sha256": "6e08a9b19df98e36da4409a8ae5990bde3ed6dc583fbea9f112cbc55421aec59", "family": "PAM session manipulation tool", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-30T15:54:44.388735+00:00", "last_seen": "2026-03-30T15:54:44.388735+00:00" }, { "type": "file-sha256", "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-30T11:40:09.598418+00:00", "last_seen": "2026-10-24T23:32:23.501319+00:00" }, { "type": "file-sha256", "sha256": "97a1e6f817d44a4f8b07fdebaf9357786742096c470eb5d78e789b6bb53979bb", "family": "SSH backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-08-02T11:28:28.153942+00:00", "last_seen": "2026-08-02T11:28:28.153942+00:00" }, { "type": "file-sha256", "sha256": "9a45029b646e2d20015695b5541f5fb76eace740bf329dc05af8ea53bd89619c", "family": "Network logging utility", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-27T02:43:30.597231+00:00", "last_seen": "2026-07-11T09:53:53.797290+00:00" }, { "type": "file-sha256", "sha256": "8a68d1c08ea31250063f70b1ccb5051db1f7ab6e17d46e9dd3cc292b9849878b", "family": "SSH key", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-09T05:54:03.232167+00:00", "last_seen": "2026-10-19T11:36:11.943164+00:00" }, { "type": "file-sha256", "sha256": "199d11d0fd7043fe9206954ed8bc7b54d1912013a2a71bdf8bb007b71bb490c8", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-27T09:17:42.987386+00:00", "last_seen": "2026-03-27T09:17:42.987386+00:00" }, { "type": "file-sha256", "sha256": "9e5b93d3095f577136717e6aae8b51fea50d66ef9123eedccfc23b8faebf6d6c", "family": "SSH-PAM Backdoor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-05T11:51:16.214307+00:00", "last_seen": "2026-10-26T09:31:07.971104+00:00" }, { "type": "file-sha256", "sha256": "9ecbeee2c88e701fe3d39e868c0a102cc77c033775f8fa9625ae83e9150a2a50", "family": "PAM session handler", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-07-27T10:16:21.581256+00:00", "last_seen": "2026-07-27T10:16:21.581256+00:00" }, { "type": "file-sha256", "sha256": "e766a00fb112124895ef5cd4c07a68de5fb50b5bc4caa0b5de4b8368c25ed52d", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-06-08T21:03:12.478796+00:00", "last_seen": "2026-06-08T21:03:12.478796+00:00" }, { "type": "file-sha256", "sha256": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-31T13:49:40.168163+00:00", "last_seen": "2026-10-26T08:06:27.177092+00:00" }, { "type": "file-sha256", "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-14T11:11:04.077459+00:00", "last_seen": "2026-07-06T12:23:14.518417+00:00" }, { "type": "file-sha256", "sha256": "88b0324bcd8c6697348597918bc0d98c7f1d9bc87961e6d1723da2fd92b8acdf", "family": "PAM session manipulator", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-04T10:16:02.511424+00:00", "last_seen": "2026-08-26T18:45:24.779184+00:00" }, { "type": "file-sha256", "sha256": "e8cd6106e6c4e2d62699cd632d37f42f6cd6691459088cf5abb375a5587fbf31", "family": "SSH-key data extractor", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-26T10:27:40.171338+00:00", "last_seen": "2026-09-26T10:27:40.171338+00:00" }, { "type": "file-sha256", "sha256": "a2f3d6d2bd82a65939f4e939bce242e8e246014fb3a9a9d5c3769ed7dcfffe24", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-10-06T17:32:35.563835+00:00", "last_seen": "2026-10-06T17:39:26.815244+00:00" }, { "type": "file-sha256", "sha256": "179a9c098282be916c330b6e9a9a9092c151931b7d217f082808f232d48da07a", "family": "API Token Harvester", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-09-25T03:10:52.222252+00:00", "last_seen": "2026-09-25T03:10:52.222252+00:00" }, { "type": "file-sha256", "sha256": "87fb3ad9908d4eed61c273d1b0d16f1a546810d249cadf314cb9fd23a27f6711", "family": null, "severity": 0, "attack": [], "cves": [], "first_seen": "2026-04-05T21:46:52.932930+00:00", "last_seen": "2026-04-05T21:46:52.932930+00:00" }, { "type": "file-sha256", "sha256": "a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2", "family": "SSH-key backdoor dropper", "severity": 0, "attack": [], "cves": [], "first_seen": "2026-03-31T13:49:31.369298+00:00", "last_seen": "2026-10-26T17:03:06.058103+00:00" } ], "usage_notes": { "license": "CC BY-NC-SA 4.0 \u2014 Attribution required, non-commercial use", "attribution": "LSN Honeypot Intelligence (shuffle-on.com)", "refresh_interval": "15 minutes", "confidence_model": "Threat scores 0-100: behavioral (honeypot hits/success), reputation (AbuseIPDB/GreyNoise), infrastructure (Shodan exposure), network (ASN risk clustering)" } }