What Stops and What Doesn't

IP Addresses — HIGH Confidence

Subnets — MEDIUM Confidence

ASN — HIGH Confidence

Domains — HIGH Confidence

Historical Passive DNS for .182 — LOW-MEDIUM — Do NOT Block

These domains were operated by real businesses during the IP's legitimate hosting phase. Blocking them would harm unrelated parties. No current threat relevance confirmed.

Fingerprints

SIG-1 · HASSH-MATCH · Recommended Primary

EVENT: SSH connection established
CONDITION: hassh == "c39f4cec145ee3d50fb590595143b9d5"
ACTION: alert [HIGH]

NOTE: Catches tool regardless of source IP, ASN, or banner string.
      Cross-IP correlation — will detect new infrastructure
      using the same Go toolkit before any reputation signals emerge.
      Cannot be trivially spoofed without changing underlying
      SSH key exchange implementation.

HASSH is derived from the SSH client's key exchange parameters — it identifies the tool implementation, not the operator's chosen presentation. This is the one signal that travels with the tool across IP rotation, ASN changes, and banner spoofing.

SIG-2 · IP-BLOCK

ACTION: block/alert
TARGETS:
  89.248.168.227  [HIGH — AbuseIPDB 100/100, CrowdSec active, confirmed probe]
  77.246.159.182  [HIGH — confirmed post-auth compromise, Ipsum score 9]

SIG-3 · ASN-BLOCK

ACTION: block
TARGET: AS202425 (IP Volume inc)
BASIS:  Spamhaus ASN-DROP designation

NOTE: Full ASN block is defensible on Spamhaus ASN-DROP alone,
      independent of the .227 specific investigation.
      Assess legitimate traffic exposure before applying.

SIG-4 · DECEPTIVE-PTR

TRIGGER: PTR lookup for any inbound connection
CONDITION: PTR string contains "no-reverse-dns-configured"
           OR PTR string mimics system-level absent-DNS messages
ACTION: alert [MEDIUM]

EXTENDED VALIDATION:
  Forward-confirm PTR — resolve the claimed domain, verify
  it resolves back to the original IP. If not: evasion confirmed.

  Check in-addr.arpa delegation vs. domain registration:
    - Legitimate absent PTR: no in-addr.arpa record exists
    - Deceptive PTR: registered domain serves the message
      while in-addr.arpa may not be delegated at all

SIG-5 · BANNER-HASSH-MISMATCH

TRIGGER: SSH connection presenting an OpenSSH banner
CONDITION: banner claims "OpenSSH" AND HASSH does NOT match
           known-good OpenSSH fingerprints for that version
ACTION: alert [MEDIUM — investigate banner spoofing]

SPECIFIC OBSERVED CASE:
  IP:     77.246.159.182
  banner: "SSH-2.0-OpenSSH_7.4"
  hassh:  "c39f4cec145ee3d50fb590595143b9d5"
  RESULT: CONFIRMED SPOOF — HASSH inconsistent with OpenSSH 7.4

SIG-6 · MULTI-PROTOCOL-SCAN

CONDITION: Same source IP appears in BOTH:
  - SSH scan detection stream
  - HTTP scan detection stream
  Within a 7-day sliding window

ACTION: escalate severity from per-protocol baseline
        to campaign-level priority

RATIONALE: Single-protocol scan events remain separate low-severity
           alerts. Overlap across protocols = coordinated campaign.

OBSERVED: 89.248.168.227
  HTTP scan onset: ~2026-06-23 (CrowdSec http:scan, 164h remaining)
  SSH scan onset:  ~2026-06-29 (CrowdSec cowrie, 23h remaining)
  Gap: 6 days — within window, both streams active simultaneously

Already Applied

MikroTik edge block on 89.248.168.227 from CrowdSec cowrie-ssh-bruteforce decision. Active at time of writing.

Recommended Additional Actions

What NOT to Do

• Do not rely on PTR lookup as a trust signal for 89.248.168.0/24 — the PTR domain is purpose-built evasion infrastructure
• Do not treat "no reverse DNS" as a lower-risk classification — that is the intended misclassification
• Do not use SSH banner version as sole tool attribution without HASSH corroboration
• Do not block historical passive DNS domains (opt-argent.ru et al.) — these were legitimate businesses; no current threat relevance