HASSH SSH client fingerprint
98ddc5604ef6a1006a2b49a58759fbe6
Seen 2026-05-04 to 2026-10-18 across the retained window.
The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS4134 sends an email when it next hits a sensor.
95
Source IPs
52
Networks
16
Countries
1
Ports hit
19.2K
Events
2
IPs / network
This fingerprint is spread thinly across many networks, which is the shape of a common, widely-used client.
Top networks
Countries
Ports targeted
Interaction
Sessions
Sessions in the last 30 days in which a sensor answered as a product and recorded what a client with this fingerprint did once inside. Logged in, ran commands, named a download and handed over files each count sessions. Reported beside the counts above and never added to them.
8
Sessions
8
Source IPs
8
Logged in
0
Ran commands
0
Named a download
0
Handed over files
Services
ATT&CK techniques
2 techniques, 2 tacticsWhat the sessions did in MITRE ATT&CK terms. The sensors map each session from its verdict, its labels and what it named, so one session can show several techniques. The count is sessions.
Logins tried
2 pairs sent in cleartext, most tried firstSource IPs in these sessions
most sessions firstAbout this fingerprint
HASSH is an MD5 over the ordered algorithm lists an SSH client offers during key exchange, before any authentication. It identifies the SSH implementation and version behind a connection at the handshake.