HASSH SSH client fingerprint
4e066189c3bbeec38c99b1855113733a
Seen 2026-05-07 to 2026-09-28 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS37963 sends an email when it next hits a sensor.
37
Source IPs
20
Networks
13
Countries
1
Ports hit
2.6K
Events
2
IPs / network
This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.
Top networks
Countries
CN 16KR 4US 4SG 4IN 1ID 1RU 1VN 1DE 1IE 1
Ports targeted
Source IPCCNetwork
Last seenEvents
117.72.166.13CNAS141679 China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch2026-09-2399
117.72.108.255CNAS141679 China Telecom Beijing Tianjin Hebei Big Data Industry Park Branch2026-09-1192
About this fingerprint
HASSH is an MD5 over the ordered algorithm lists an SSH client offers during key exchange, before any authentication. It identifies the SSH implementation and version behind a connection at the handshake.