HASSH SSH client fingerprint

52c99fce46b6758a467102ce5bd1c565

Seen 2026-10-09 to 2026-10-15 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS398324 sends an email when it next hits a sensor.

Source IPs

Networks

Countries

Ports hit

Events

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS398324 Censys, Inc.19 IPs19

AS398705 Censys, Inc.3 IPs3

Countries

US 22

Ports targeted

22/tcp 22

Source IPCCNetwork Last seenEvents

66.132.195.109USAS398324 Censys, Inc.2026-10-091

66.132.172.111USAS398324 Censys, Inc.2026-10-121

66.132.195.40USAS398324 Censys, Inc.2026-10-131

66.132.172.98USAS398324 Censys, Inc.2026-10-091

66.132.172.180USAS398324 Censys, Inc.2026-10-101

66.132.195.125USAS398324 Censys, Inc.2026-10-091

66.132.186.181USAS398324 Censys, Inc.2026-10-141

66.132.172.218USAS398324 Censys, Inc.2026-10-151

66.132.186.203USAS398324 Censys, Inc.2026-10-141

66.132.195.94USAS398324 Censys, Inc.2026-10-101

66.132.172.109USAS398324 Censys, Inc.2026-10-131

66.132.195.176USAS398324 Censys, Inc.2026-10-131

66.132.186.192USAS398324 Censys, Inc.2026-10-111

66.132.172.214USAS398324 Censys, Inc.2026-10-121

66.132.224.87USAS398324 Censys, Inc.2026-10-141

66.132.172.101USAS398324 Censys, Inc.2026-10-131

66.132.172.107USAS398324 Censys, Inc.2026-10-131

167.94.146.50USAS398705 Censys, Inc.2026-10-111

66.132.195.67USAS398324 Censys, Inc.2026-10-121

167.94.146.59USAS398705 Censys, Inc.2026-10-111

About this fingerprint

HASSH is an MD5 over the ordered algorithm lists an SSH client offers during key exchange, before any authentication. It identifies the SSH implementation and version behind a connection at the handshake.