HASSH SSH client fingerprint

7216c7c473918b4f83d1139b3c70dbf9

Seen 2026-05-04 to 2026-10-08 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS6939 sends an email when it next hits a sensor.

238

Source IPs

Networks

Countries

Ports hit

1.5K

Events

238

IPs / network

This fingerprint is concentrated: many addresses on very few networks, which is what a single coordinated operation tends to look like.

Top networks

AS6939 Hurricane Electric LLC238 IPs1.5K

Countries

US 238

Ports targeted

51922/tcp 112 4118/tcp 111 3389/tcp 110 53282/tcp 110 22522/tcp 109 22122/tcp 108 212/tcp 107 1337/tcp 107 22222/tcp 107 830/tcp 106 57722/tcp 106 50000/tcp 105

Source IPCCNetwork Last seenEvents

64.62.197.31USAS6939 Hurricane Electric LLC2026-10-0713

64.62.197.69USAS6939 Hurricane Electric LLC2026-10-0813

64.62.197.114USAS6939 Hurricane Electric LLC2026-10-0713

64.62.197.66USAS6939 Hurricane Electric LLC2026-10-0813

64.62.197.73USAS6939 Hurricane Electric LLC2026-10-0612

64.62.197.200USAS6939 Hurricane Electric LLC2026-10-0412

64.62.197.194USAS6939 Hurricane Electric LLC2026-10-0412

64.62.197.186USAS6939 Hurricane Electric LLC2026-10-0412

64.62.197.74USAS6939 Hurricane Electric LLC2026-10-0711

64.62.197.34USAS6939 Hurricane Electric LLC2026-10-0611

64.62.197.98USAS6939 Hurricane Electric LLC2026-10-0511

64.62.197.70USAS6939 Hurricane Electric LLC2026-10-0411

64.62.197.26USAS6939 Hurricane Electric LLC2026-10-0611

64.62.197.110USAS6939 Hurricane Electric LLC2026-10-0811

64.62.197.93USAS6939 Hurricane Electric LLC2026-10-0811

64.62.197.55USAS6939 Hurricane Electric LLC2026-10-0810

64.62.197.53USAS6939 Hurricane Electric LLC2026-10-0710

64.62.197.71USAS6939 Hurricane Electric LLC2026-10-0310

64.62.197.100USAS6939 Hurricane Electric LLC2026-10-0310

64.62.197.174USAS6939 Hurricane Electric LLC2026-10-0710

About this fingerprint

HASSH is an MD5 over the ordered algorithm lists an SSH client offers during key exchange, before any authentication. It identifies the SSH implementation and version behind a connection at the handshake.