HoneyLabs
Lookup
Explore
CVEsEarly actorsPayloadsCampaignsEmissions IndexPortsUser-agents
Integrations
OverviewMCPFeedsAPI / EnrichSplunk ESMicrosoft SentinelElasticMISPOpenCTICrowdSec
PricingDocsBlog
Dashboard

HASSH SSH client fingerprint

bc3aee897af7d3feb9fc37b89c7d15c9

Seen 2026-05-08 to 2026-09-25 across the retained window.

Open in lookup → Addresses as a feed

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS209334 sends an email when it next hits a sensor.

12

Source IPs

1

Networks

1

Countries

2

Ports hit

13

Events

12

IPs / network

Top networks

AS209334 Modat B.V.12 IPs13

Countries

CA 12

Ports targeted

22/tcp 112222/tcp 2
Source IPCCNetwork Last seenEvents
85.217.149.24CAAS209334 Modat B.V.2026-09-252
85.217.149.40CAAS209334 Modat B.V.2026-09-231
85.217.149.0CAAS209334 Modat B.V.2026-09-211
85.217.149.28CAAS209334 Modat B.V.2026-09-241
85.217.149.9CAAS209334 Modat B.V.2026-09-241
85.217.149.19CAAS209334 Modat B.V.2026-09-231
85.217.149.58CAAS209334 Modat B.V.2026-09-211
85.217.149.12CAAS209334 Modat B.V.2026-09-251
85.217.149.4CAAS209334 Modat B.V.2026-09-251
85.217.149.25CAAS209334 Modat B.V.2026-09-241
85.217.149.32CAAS209334 Modat B.V.2026-09-211
85.217.149.61CAAS209334 Modat B.V.2026-09-251

About this fingerprint

HASSH is an MD5 over the ordered algorithm lists an SSH client offers during key exchange, before any authentication. It identifies the SSH implementation and version behind a connection at the handshake.