{"businesses":[{"active_days":59,"as_name":"AS197170 TechTies Inc.","asn":"AS197170","asn_org":"TechTies Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"TechTies Inc.","not_a_legal_finding":true,"org":"TechTies Inc","peak_day":"2026-08-11","peak_day_events":6358,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":15715,"sw_events":0,"total_events":15715,"unique_ips":175,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":63,"as_name":"AS47890 UNMANAGED LTD","asn":"AS47890","asn_org":"UNMANAGED LTD","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Unmanaged LTD","not_a_legal_finding":true,"org":"Unmanaged LTD","peak_day":"2026-08-12","peak_day_events":1517,"share_bh":0.0,"share_ssh":98.8,"share_sw":0.0,"ssh_events":14479,"sw_events":0,"total_events":14660,"unique_ips":26,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":12,"as_name":"AS37963 Hangzhou Alibaba Advertising Co.,Ltd.","asn":"AS37963","asn_org":"Hangzhou Alibaba Advertising Co.,Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Hangzhou Alibaba Advertising Co., Ltd.","not_a_legal_finding":true,"org":"Aliyun Computing Co., LTD","peak_day":"2026-08-11","peak_day_events":987,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":998,"sw_events":0,"total_events":998,"unique_ips":11,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":59,"as_name":"AS48090 TECHOFF SRV LIMITED","asn":"AS48090","asn_org":"TECHOFF SRV LIMITED","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"bulletproof_or_abuse_friendly_hosting","category_label":"Bulletproof Or Abuse Friendly Hosting","isp":"Techoff SRV Limited","not_a_legal_finding":true,"org":"Techoff SRV Limited","peak_day":"2026-08-10","peak_day_events":801,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":5351,"sw_events":0,"total_events":5426,"unique_ips":14,"why_likely":"Hosting often seen in abuse reports. Tenants may run scanners/bruteforce; file with the host\u2019s abuse@."},{"active_days":30,"as_name":"AS208137 Feo Prest SRL","asn":"AS208137","asn_org":"Feo Prest SRL","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":6,"category":"unknown_network","category_label":"Unknown Network","isp":"Feo Prest SRL","not_a_legal_finding":true,"org":"Feo Prest SRL","peak_day":"2026-08-12","peak_day_events":681,"share_bh":0.8,"share_ssh":99.2,"share_sw":0.0,"ssh_events":776,"sw_events":0,"total_events":782,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":58,"as_name":"AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED","asn":"AS135377","asn_org":"UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Zenlayer Inc","not_a_legal_finding":true,"org":"Zenlayer Inc","peak_day":"2026-08-14","peak_day_events":534,"share_bh":0.0,"share_ssh":97.6,"share_sw":0.0,"ssh_events":2261,"sw_events":0,"total_events":2317,"unique_ips":80,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":24,"as_name":"AS198364 BANATSYNC SRL","asn":"AS198364","asn_org":"BANATSYNC SRL","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Banatsync SRL","not_a_legal_finding":true,"org":"RocketCloud","peak_day":"2026-08-12","peak_day_events":521,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":829,"sw_events":0,"total_events":829,"unique_ips":25,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":58,"as_name":"AS4766 Korea Telecom","asn":"AS4766","asn_org":"Korea Telecom","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"PUBNET","not_a_legal_finding":true,"org":"yuhyeonseog","peak_day":"2026-08-17","peak_day_events":377,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":2705,"sw_events":0,"total_events":2751,"unique_ips":114,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":42,"as_name":"AS4837 CHINA UNICOM China169 Backbone","asn":"AS4837","asn_org":"CHINA UNICOM China169 Backbone","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":11,"category":"unknown_network","category_label":"Unknown Network","isp":"China Unicom Sichuan Province Network","not_a_legal_finding":true,"org":"Zhengzhou Gainet Computer Network Technology Co., Ltd.","peak_day":"2026-08-16","peak_day_events":353,"share_bh":1.0,"share_ssh":98.4,"share_sw":0.0,"ssh_events":1094,"sw_events":0,"total_events":1112,"unique_ips":34,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":58,"as_name":"AS4134 CHINANET BACKBONE","asn":"AS4134","asn_org":"CHINANET BACKBONE","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":3,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Chinanet","not_a_legal_finding":true,"org":"shenzhendxRED","peak_day":"2026-08-17","peak_day_events":351,"share_bh":0.2,"share_ssh":97.8,"share_sw":0.0,"ssh_events":1177,"sw_events":0,"total_events":1204,"unique_ips":94,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":52,"as_name":"AS137718 Beijing Volcano Engine Technology Co., Ltd.","asn":"AS137718","asn_org":"Beijing Volcano Engine Technology Co., Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"VOLCANO-ENGINE","not_a_legal_finding":true,"org":"China Internet Network Information Center","peak_day":"2026-08-19","peak_day_events":347,"share_bh":0.0,"share_ssh":99.1,"share_sw":0.0,"ssh_events":1181,"sw_events":0,"total_events":1192,"unique_ips":97,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":14,"as_name":"AS23724 IDC, China Telecommunications Corporation","asn":"AS23724","asn_org":"IDC, China Telecommunications Corporation","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"UCLOUD","not_a_legal_finding":true,"org":"Shanghai UCloud Information Technology Company Limited","peak_day":"2026-08-14","peak_day_events":342,"share_bh":0.0,"share_ssh":99.6,"share_sw":0.0,"ssh_events":485,"sw_events":0,"total_events":487,"unique_ips":13,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":11,"as_name":"AS36947 Telecom Algeria","asn":"AS36947","asn_org":"Telecom Algeria","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"new","not_a_legal_finding":true,"org":"Algerie Telecom","peak_day":"2026-08-18","peak_day_events":342,"share_bh":0.0,"share_ssh":99.4,"share_sw":0.0,"ssh_events":478,"sw_events":0,"total_events":481,"unique_ips":11,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":12,"as_name":"AS37182 Tanzania Education And Research Network","asn":"AS37182","asn_org":"Tanzania Education And Research Network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"research_education","category_label":"Research Education","isp":"Tanzania Education And Research Network","not_a_legal_finding":true,"org":"Ternet Services","peak_day":"2026-08-12","peak_day_events":342,"share_bh":0.0,"share_ssh":99.8,"share_sw":0.0,"ssh_events":476,"sw_events":0,"total_events":477,"unique_ips":6,"why_likely":"Research/education network. Could be lab scanners or compromised student hosts."},{"active_days":4,"as_name":"AS18229 CtrlS","asn":"AS18229","asn_org":"CtrlS","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"CtrlS","not_a_legal_finding":true,"org":"Pioneer Elabs Ltd.","peak_day":"2026-08-18","peak_day_events":342,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":392,"sw_events":0,"total_events":392,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS38283 CHINANET SiChuan Telecom Internet Data Center","asn":"AS38283","asn_org":"CHINANET SiChuan Telecom Internet Data Center","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"China Internet Network Information Center","not_a_legal_finding":true,"org":"Chinanet SC","peak_day":"2026-08-15","peak_day_events":342,"share_bh":0.0,"share_ssh":99.5,"share_sw":0.0,"ssh_events":374,"sw_events":0,"total_events":376,"unique_ips":5,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":2,"as_name":"AS34534 FBW NETWORKS SAS","asn":"AS34534","asn_org":"FBW NETWORKS SAS","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"FBW NETWORKS SAS","not_a_legal_finding":true,"org":"FBW NETWORKS","peak_day":"2026-08-14","peak_day_events":342,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":345,"sw_events":0,"total_events":345,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS4618 Internet Thailand Company Limited","asn":"AS4618","asn_org":"Internet Thailand Company Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Internet Thailand Company Ltd.","not_a_legal_finding":true,"org":"Internet Thailand Company Ltd","peak_day":"2026-08-13","peak_day_events":342,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":342,"sw_events":0,"total_events":342,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":7,"as_name":"AS154383 ZORNTECH WEB SOLUTIONS","asn":"AS154383","asn_org":"ZORNTECH WEB SOLUTIONS","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Zorntech Web Solutions","not_a_legal_finding":true,"org":"BearShield Technologies S.R.O","peak_day":"2026-08-12","peak_day_events":334,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":363,"sw_events":0,"total_events":363,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":59,"as_name":"AS14061 DigitalOcean, LLC","asn":"AS14061","asn_org":"DigitalOcean, LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"DigitalOcean, LLC","not_a_legal_finding":true,"org":"Digitalocean","peak_day":"2026-08-13","peak_day_events":327,"share_bh":0.0,"share_ssh":98.2,"share_sw":0.0,"ssh_events":2601,"sw_events":0,"total_events":2648,"unique_ips":172,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":1,"as_name":"AS216054 Taymaz Gostaran Naghshe Almas Co. ( Ltd )","asn":"AS216054","asn_org":"Taymaz Gostaran Naghshe Almas Co. ( Ltd )","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Taymaz Gostaran Naghshe Almas Co. ( Ltd )","not_a_legal_finding":true,"org":"MohammadReza Javadi Moheb","peak_day":"2026-08-12","peak_day_events":254,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":254,"sw_events":0,"total_events":254,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS137695 CHINATELECOM Xinjiang Wulumuqi MAN network","asn":"AS137695","asn_org":"CHINATELECOM Xinjiang Wulumuqi MAN network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"CHINATELECOM Xinjiang Wulumuqi MAN network","not_a_legal_finding":true,"org":"Chinanet ZJ","peak_day":"2026-08-13","peak_day_events":228,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":240,"sw_events":0,"total_events":240,"unique_ips":2,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":11,"as_name":"AS202660 Uzbektelekom Joint Stock Company","asn":"AS202660","asn_org":"Uzbektelekom Joint Stock Company","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"\"Uzbektelekom\" Joint Stock Company","not_a_legal_finding":true,"org":"Uztelecom DC","peak_day":"2026-08-17","peak_day_events":213,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":768,"sw_events":0,"total_events":768,"unique_ips":7,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":58,"as_name":"AS16276 OVH SAS","asn":"AS16276","asn_org":"OVH SAS","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"OVH SAS","not_a_legal_finding":true,"org":"Yellice Celalettin","peak_day":"2026-08-17","peak_day_events":207,"share_bh":0.0,"share_ssh":97.2,"share_sw":0.0,"ssh_events":2036,"sw_events":0,"total_events":2094,"unique_ips":120,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":14,"as_name":"AS4760 HKT Limited","asn":"AS4760","asn_org":"HKT Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PCCW IMSBiz","not_a_legal_finding":true,"org":"PCCW IMS Ltd (PCCW Business Internet Access)","peak_day":"2026-08-11","peak_day_events":187,"share_bh":0.0,"share_ssh":99.4,"share_sw":0.0,"ssh_events":360,"sw_events":0,"total_events":362,"unique_ips":8,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS12552 GlobalConnect AB","asn":"AS12552","asn_org":"GlobalConnect AB","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"GlobalConnect AB","not_a_legal_finding":true,"org":"IP-ONLY","peak_day":"2026-08-11","peak_day_events":187,"share_bh":0.0,"share_ssh":99.0,"share_sw":0.0,"ssh_events":197,"sw_events":0,"total_events":199,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":49,"as_name":"AS31898 Oracle Corporation","asn":"AS31898","asn_org":"Oracle Corporation","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Vodien Internet Solutions Pte Ltd","not_a_legal_finding":true,"org":"Vodien Internet Solutions Pte Ltd","peak_day":"2026-09-04","peak_day_events":178,"share_bh":0.0,"share_ssh":96.8,"share_sw":0.0,"ssh_events":1283,"sw_events":0,"total_events":1326,"unique_ips":65,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS23650 AS Number for CHINANET jiangsu province backbone","asn":"AS23650","asn_org":"AS Number for CHINANET jiangsu province backbone","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Chinanet Jiangsu","not_a_legal_finding":true,"org":"Jiangsu Dongyun Cloud computing co., LTD","peak_day":"2026-08-10","peak_day_events":177,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":177,"sw_events":0,"total_events":177,"unique_ips":1,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":2,"as_name":"AS49870 Alsycon B.V.","asn":"AS49870","asn_org":"Alsycon B.V.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"HostUS","not_a_legal_finding":true,"org":"HostUS Solutions LLC","peak_day":"2026-08-12","peak_day_events":159,"share_bh":0.0,"share_ssh":99.4,"share_sw":0.0,"ssh_events":159,"sw_events":0,"total_events":160,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS401443 WAP.AC LLC","asn":"AS401443","asn_org":"WAP.AC LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"WAP.AC LLC","not_a_legal_finding":true,"org":"FatDisco Ltd","peak_day":"2026-09-08","peak_day_events":153,"share_bh":0.0,"share_ssh":99.3,"share_sw":0.0,"ssh_events":152,"sw_events":0,"total_events":153,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS150462 PT Air Lintas Komunikasi","asn":"AS150462","asn_org":"PT Air Lintas Komunikasi","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PT Air Lintas Komunikasi","not_a_legal_finding":true,"org":"PT Air Lintas Komunikasi","peak_day":"2026-09-05","peak_day_events":144,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":618,"sw_events":0,"total_events":618,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":45,"as_name":"AS150436 Byteplus Pte. Ltd.","asn":"AS150436","asn_org":"Byteplus Pte. Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Byteplus Pte. Ltd.","not_a_legal_finding":true,"org":"Byteplus Pte. Ltd.","peak_day":"2026-08-12","peak_day_events":142,"share_bh":0.0,"share_ssh":98.1,"share_sw":0.0,"ssh_events":1159,"sw_events":0,"total_events":1181,"unique_ips":42,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":55,"as_name":"AS8075 Microsoft Corporation","asn":"AS8075","asn_org":"Microsoft Corporation","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"bigtech_cloud_or_security","category_label":"Bigtech Cloud Or Security","isp":"Microsoft Corporation","not_a_legal_finding":true,"org":"Microsoft Corporation","peak_day":"2026-08-16","peak_day_events":139,"share_bh":0.0,"share_ssh":98.0,"share_sw":0.0,"ssh_events":2104,"sw_events":0,"total_events":2148,"unique_ips":98,"why_likely":"Large cloud or security ASN. Traffic is often customer VMs, health checks, or security research \u2014 not one company \u201cattacking you\u201d as a brand."},{"active_days":10,"as_name":"AS215439 PLAY2GO INTERNATIONAL LIMITED","asn":"AS215439","asn_org":"PLAY2GO INTERNATIONAL LIMITED","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Play2go International Limited","not_a_legal_finding":true,"org":"Play2go Customers Network","peak_day":"2026-08-25","peak_day_events":124,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":178,"sw_events":0,"total_events":180,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS265919 BB Host LTDA","asn":"AS265919","asn_org":"BB Host LTDA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"BB Host","not_a_legal_finding":true,"org":"MB \"Ipumanija\"","peak_day":"2026-09-06","peak_day_events":123,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":324,"sw_events":0,"total_events":324,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":10,"as_name":"AS22884 TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.","asn":"AS22884","asn_org":"TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Total Play Telecomunicaciones SA De CV","not_a_legal_finding":true,"org":"TOTAL PLAY TELECOMUNICACIONES, S.A.P.I. DE C.V","peak_day":"2026-08-19","peak_day_events":123,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":269,"sw_events":0,"total_events":272,"unique_ips":3,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":49,"as_name":"AS132203 Tencent Building, Kejizhongyi Avenue","asn":"AS132203","asn_org":"Tencent Building, Kejizhongyi Avenue","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Tencent Cloud Computing (Beijing) Co","not_a_legal_finding":true,"org":"Tencent cloud computing (Beijing) Co., Ltd.","peak_day":"2026-08-12","peak_day_events":117,"share_bh":0.0,"share_ssh":96.9,"share_sw":0.0,"ssh_events":1231,"sw_events":0,"total_events":1270,"unique_ips":72,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":1,"as_name":"AS61414 EDGENAP LTD","asn":"AS61414","asn_org":"EDGENAP LTD","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Klayer LLC","not_a_legal_finding":true,"org":"","peak_day":"2026-08-12","peak_day_events":111,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":111,"sw_events":0,"total_events":111,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":32,"as_name":"AS8560 IONOS SE","asn":"AS8560","asn_org":"IONOS SE","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"MISTRAL","not_a_legal_finding":true,"org":"Strato AG","peak_day":"2026-08-15","peak_day_events":101,"share_bh":0.0,"share_ssh":98.2,"share_sw":0.0,"ssh_events":558,"sw_events":0,"total_events":568,"unique_ips":31,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":31,"as_name":"AS36352 HostPapa","asn":"AS36352","asn_org":"HostPapa","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"HostPapa","not_a_legal_finding":true,"org":"VPS ACE","peak_day":"2026-08-15","peak_day_events":99,"share_bh":0.0,"share_ssh":98.2,"share_sw":0.0,"ssh_events":638,"sw_events":0,"total_events":650,"unique_ips":32,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":12,"as_name":"AS26496 GoDaddy.com, LLC","asn":"AS26496","asn_org":"GoDaddy.com, LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Godaddy.com","not_a_legal_finding":true,"org":"Godaddy.com","peak_day":"2026-08-12","peak_day_events":97,"share_bh":0.0,"share_ssh":98.7,"share_sw":0.0,"ssh_events":154,"sw_events":0,"total_events":156,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":12,"as_name":"AS211486 Alferov Aleksey Aleksandrovich","asn":"AS211486","asn_org":"Alferov Aleksey Aleksandrovich","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Alferov Aleksey Aleksandrovich","not_a_legal_finding":true,"org":"NEW","peak_day":"2026-10-03","peak_day_events":90,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":827,"sw_events":0,"total_events":827,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":30,"as_name":"AS213790 Limited Network LTD","asn":"AS213790","asn_org":"Limited Network LTD","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Limited Network LTD","not_a_legal_finding":true,"org":"Secure Internet LLC","peak_day":"2026-08-10","peak_day_events":90,"share_bh":0.0,"share_ssh":95.5,"share_sw":0.0,"ssh_events":317,"sw_events":0,"total_events":332,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS268622 OLIVEIRA TELECOM","asn":"AS268622","asn_org":"OLIVEIRA TELECOM","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Oliveira Telecom","not_a_legal_finding":true,"org":"Oliveira Telecom","peak_day":"2026-08-11","peak_day_events":87,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":87,"sw_events":0,"total_events":87,"unique_ips":1,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":28,"as_name":"AS9318 SK Broadband Co Ltd","asn":"AS9318","asn_org":"SK Broadband Co Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"broadNnet","not_a_legal_finding":true,"org":"broadNnet","peak_day":"2026-08-10","peak_day_events":86,"share_bh":0.0,"share_ssh":98.8,"share_sw":0.0,"ssh_events":505,"sw_events":0,"total_events":511,"unique_ips":20,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":19,"as_name":"AS4609 Companhia de Telecomunicacoes de Macau SARL","asn":"AS4609","asn_org":"Companhia de Telecomunicacoes de Macau SARL","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Companhia de Telecomunicacoes de Macau","not_a_legal_finding":true,"org":"CTM Internet Service","peak_day":"2026-08-24","peak_day_events":86,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":348,"sw_events":0,"total_events":352,"unique_ips":3,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":15,"as_name":"AS142002 Scloud Pte Ltd","asn":"AS142002","asn_org":"Scloud Pte Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Scloud Pte Ltd","not_a_legal_finding":true,"org":"Scloud Pte Ltd","peak_day":"2026-08-12","peak_day_events":85,"share_bh":0.0,"share_ssh":97.8,"share_sw":0.0,"ssh_events":270,"sw_events":0,"total_events":276,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":44,"as_name":"AS9808 China Mobile Communications Group Co., Ltd.","asn":"AS9808","asn_org":"China Mobile Communications Group Co., Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"UCLOUD","not_a_legal_finding":true,"org":"Shanghai UCloud Information Technology Company Limited","peak_day":"2026-08-12","peak_day_events":84,"share_bh":0.0,"share_ssh":97.9,"share_sw":0.0,"ssh_events":547,"sw_events":0,"total_events":559,"unique_ips":33,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":28,"as_name":"AS398101 GoDaddy.com, LLC","asn":"AS398101","asn_org":"GoDaddy.com, LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"GoDaddy.com, LLC","not_a_legal_finding":true,"org":"Host Europe GmbH","peak_day":"2026-08-10","peak_day_events":84,"share_bh":0.0,"share_ssh":97.8,"share_sw":0.0,"ssh_events":448,"sw_events":0,"total_events":458,"unique_ips":13,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":7,"as_name":"AS17858 LG POWERCOMM","asn":"AS17858","asn_org":"LG POWERCOMM","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"LG POWERCOMM","not_a_legal_finding":true,"org":"Xpeed","peak_day":"2026-08-18","peak_day_events":84,"share_bh":0.0,"share_ssh":98.5,"share_sw":0.0,"ssh_events":133,"sw_events":0,"total_events":135,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS50867 HOSTKEY B.V.","asn":"AS50867","asn_org":"HOSTKEY B.V.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Hostkey B.V.","not_a_legal_finding":true,"org":"LLC \"Server v arendy\"","peak_day":"2026-08-18","peak_day_events":84,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":121,"sw_events":0,"total_events":121,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS38513 PT Aplikanusa Lintasarta","asn":"AS38513","asn_org":"PT Aplikanusa Lintasarta","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PT Aplikanusa Lintasarta","not_a_legal_finding":true,"org":"PT NAWASENA WASA ANUGERAH","peak_day":"2026-08-10","peak_day_events":83,"share_bh":0.0,"share_ssh":98.5,"share_sw":0.0,"ssh_events":264,"sw_events":0,"total_events":268,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":17,"as_name":"AS18881 TELEF\u00d4NICA BRASIL S.A","asn":"AS18881","asn_org":"TELEF\u00d4NICA BRASIL S.A","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Vivo","not_a_legal_finding":true,"org":"TELEF\ufffdNICA BRASIL S.A","peak_day":"2026-08-11","peak_day_events":82,"share_bh":0.0,"share_ssh":98.4,"share_sw":0.0,"ssh_events":249,"sw_events":0,"total_events":253,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS17665 ONEOTT INTERTAINMENT LIMITED","asn":"AS17665","asn_org":"ONEOTT INTERTAINMENT LIMITED","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"In2cable MIDC Mumbai","not_a_legal_finding":true,"org":"Indusind Media And Communication Ltd.","peak_day":"2026-08-12","peak_day_events":82,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":139,"sw_events":0,"total_events":141,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS23889 Mauritius Telecom Ltd","asn":"AS23889","asn_org":"Mauritius Telecom Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"telecomplus","not_a_legal_finding":true,"org":"","peak_day":"2026-08-12","peak_day_events":81,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":157,"sw_events":0,"total_events":157,"unique_ips":2,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":21,"as_name":"AS29465 MTN NIGERIA Communication limited","asn":"AS29465","asn_org":"MTN NIGERIA Communication limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"MTN NIGERIA Communication limited","not_a_legal_finding":true,"org":"MTN Nigeria","peak_day":"2026-08-10","peak_day_events":80,"share_bh":0.0,"share_ssh":97.4,"share_sw":0.0,"ssh_events":373,"sw_events":0,"total_events":383,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS55933 Cloudie Limited","asn":"AS55933","asn_org":"Cloudie Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Hosted in Cloudie Limited","not_a_legal_finding":true,"org":"Hosted in Cloudie Limited","peak_day":"2026-08-12","peak_day_events":80,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":260,"sw_events":0,"total_events":263,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS58065 Orion Network Limited","asn":"AS58065","asn_org":"Orion Network Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Orion Network Limited","not_a_legal_finding":true,"org":"Fiber Grid","peak_day":"2026-08-11","peak_day_events":80,"share_bh":0.0,"share_ssh":99.6,"share_sw":0.0,"ssh_events":254,"sw_events":0,"total_events":255,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":19,"as_name":"AS58519 Cloud Computing Corporation","asn":"AS58519","asn_org":"Cloud Computing Corporation","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Cloud Computing Corporation","not_a_legal_finding":true,"org":"Inner Mongolia Ruitong Network Technology Co., Ltd","peak_day":"2026-08-11","peak_day_events":80,"share_bh":0.0,"share_ssh":97.8,"share_sw":0.0,"ssh_events":179,"sw_events":0,"total_events":183,"unique_ips":15,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":10,"as_name":"AS4812 China Telecom (Group)","asn":"AS4812","asn_org":"China Telecom (Group)","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"China Telecom (Group)","not_a_legal_finding":true,"org":"Shanghai Xinding International Cargo Transport Angent Co., Ltd.","peak_day":"2026-08-11","peak_day_events":80,"share_bh":0.0,"share_ssh":99.2,"share_sw":0.0,"ssh_events":118,"sw_events":0,"total_events":119,"unique_ips":6,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":4,"as_name":"AS37284 Aljeel Aljadeed For Technology","asn":"AS37284","asn_org":"Aljeel Aljadeed For Technology","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Aljeel Aljadeed Technology","not_a_legal_finding":true,"org":"Zagel Tech Solutions","peak_day":"2026-08-17","peak_day_events":78,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":166,"sw_events":0,"total_events":166,"unique_ips":31,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS197540 netcup GmbH","asn":"AS197540","asn_org":"netcup GmbH","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"netcup GmbH","not_a_legal_finding":true,"org":"netcup GmbH","peak_day":"2026-08-19","peak_day_events":78,"share_bh":0.0,"share_ssh":97.8,"share_sw":0.0,"ssh_events":90,"sw_events":0,"total_events":92,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":12,"as_name":"AS213474 HomeLine Broadband LLC","asn":"AS213474","asn_org":"HomeLine Broadband LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"HomeLine Broadband LLC","not_a_legal_finding":true,"org":"Vlad Cojuhari","peak_day":"2026-09-10","peak_day_events":76,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":503,"sw_events":0,"total_events":503,"unique_ips":2,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":63,"as_name":"AS396982 Google LLC","asn":"AS396982","asn_org":"Google LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"bigtech_cloud_or_security","category_label":"Bigtech Cloud Or Security","isp":"Google LLC","not_a_legal_finding":true,"org":"Google Cloud (us-west2)","peak_day":"2026-08-15","peak_day_events":75,"share_bh":0.0,"share_ssh":97.8,"share_sw":0.0,"ssh_events":795,"sw_events":0,"total_events":813,"unique_ips":183,"why_likely":"Large cloud or security ASN. Traffic is often customer VMs, health checks, or security research \u2014 not one company \u201cattacking you\u201d as a brand."},{"active_days":46,"as_name":"AS38365 Beijing Baidu Netcom Science and Technology Co., Ltd.","asn":"AS38365","asn_org":"Beijing Baidu Netcom Science and Technology Co., Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Beijing Baidu Netcom Science and Technology Co., Ltd.","not_a_legal_finding":true,"org":"Beijing Baidu Netcom Science and Technology Co., Ltd.","peak_day":"2026-08-11","peak_day_events":75,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":650,"sw_events":0,"total_events":659,"unique_ips":69,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS150692 Golden Dragon 2000","asn":"AS150692","asn_org":"Golden Dragon 2000","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Golden Dragon 2000 Company Limited","not_a_legal_finding":true,"org":"Dragon","peak_day":"2026-08-11","peak_day_events":75,"share_bh":0.0,"share_ssh":99.2,"share_sw":0.0,"ssh_events":118,"sw_events":0,"total_events":119,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS34224 Neterra Ltd.","asn":"AS34224","asn_org":"Neterra Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Neterra Ltd.","not_a_legal_finding":true,"org":"Elektron Invest Ltd.","peak_day":"2026-08-12","peak_day_events":74,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":100,"sw_events":0,"total_events":100,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":11,"as_name":"AS138608 Cloud Host Pte Ltd","asn":"AS138608","asn_org":"Cloud Host Pte Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Cloud Host Pte Ltd","not_a_legal_finding":true,"org":"Cloud Host Pte Ltd","peak_day":"2026-08-11","peak_day_events":73,"share_bh":0.0,"share_ssh":98.1,"share_sw":0.0,"ssh_events":209,"sw_events":0,"total_events":213,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":11,"as_name":"AS8473 Bahnhof AB","asn":"AS8473","asn_org":"Bahnhof AB","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Bahnhof Internet","not_a_legal_finding":true,"org":"General Private NET A463","peak_day":"2026-08-16","peak_day_events":71,"share_bh":0.0,"share_ssh":99.5,"share_sw":0.0,"ssh_events":183,"sw_events":0,"total_events":184,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS212219 HOSTING DUNYAM","asn":"AS212219","asn_org":"HOSTING DUNYAM","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi","not_a_legal_finding":true,"org":"Hosting Dunyam Bilisim Teknolojileri Ticaret Limited Sirketi","peak_day":"2026-09-01","peak_day_events":71,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":159,"sw_events":0,"total_events":159,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":9,"as_name":"AS3243 MEO - SERVICOS DE COMUNICACOES E MULTIMEDIA S.A.","asn":"AS3243","asn_org":"MEO - SERVICOS DE COMUNICACOES E MULTIMEDIA S.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PT Comunicacoes S.A.","not_a_legal_finding":true,"org":"PT Comunicacoes S.A.","peak_day":"2026-08-13","peak_day_events":71,"share_bh":0.0,"share_ssh":97.9,"share_sw":0.0,"ssh_events":137,"sw_events":0,"total_events":140,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":17,"as_name":"AS3269 Telecom Italia S.p.A.","asn":"AS3269","asn_org":"Telecom Italia S.p.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Telecom Italia S.p.A. TIN EASY LITE","not_a_legal_finding":true,"org":"Telecom Italia Spa","peak_day":"2026-08-13","peak_day_events":69,"share_bh":0.0,"share_ssh":97.1,"share_sw":0.0,"ssh_events":201,"sw_events":0,"total_events":207,"unique_ips":10,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":2,"as_name":"AS55430 Starhub Ltd","asn":"AS55430","asn_org":"Starhub Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Starhub Internet Pte Ltd","not_a_legal_finding":true,"org":"StarHub Cable Vision Ltd","peak_day":"2026-10-11","peak_day_events":69,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":70,"sw_events":0,"total_events":70,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":27,"as_name":"AS135905 VIETNAM POSTS AND TELECOMMUNICATIONS GROUP","asn":"AS135905","asn_org":"VIETNAM POSTS AND TELECOMMUNICATIONS GROUP","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Vietnam Posts and Telecommunications Group","not_a_legal_finding":true,"org":"Vietnix cloud company limited","peak_day":"2026-08-14","peak_day_events":68,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":531,"sw_events":0,"total_events":537,"unique_ips":17,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":10,"as_name":"AS9905 Linknet ASN","asn":"AS9905","asn_org":"Linknet ASN","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PT. LINKNET","not_a_legal_finding":true,"org":"","peak_day":"2026-08-17","peak_day_events":67,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":210,"sw_events":0,"total_events":210,"unique_ips":6,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS394695 PDR","asn":"AS394695","asn_org":"PDR","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PDR","not_a_legal_finding":true,"org":"P.D.R Solutions FZC","peak_day":"2026-08-24","peak_day_events":67,"share_bh":0.0,"share_ssh":99.3,"share_sw":0.0,"ssh_events":144,"sw_events":0,"total_events":145,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":19,"as_name":"AS9498 BHARTI Airtel Ltd.","asn":"AS9498","asn_org":"BHARTI Airtel Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Bharti Airtel Ltd.","not_a_legal_finding":true,"org":"Nbcc LTD","peak_day":"2026-08-15","peak_day_events":65,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":270,"sw_events":0,"total_events":273,"unique_ips":12,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":31,"as_name":"AS24560 Bharti Airtel Ltd., Telemedia Services","asn":"AS24560","asn_org":"Bharti Airtel Ltd., Telemedia Services","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Bharti Airtel Ltd.","not_a_legal_finding":true,"org":"Bharti Telenet Ltd.","peak_day":"2026-08-14","peak_day_events":63,"share_bh":0.0,"share_ssh":98.8,"share_sw":0.0,"ssh_events":586,"sw_events":0,"total_events":593,"unique_ips":22,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":18,"as_name":"AS7922 Comcast Cable Communications, LLC","asn":"AS7922","asn_org":"Comcast Cable Communications, LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Comcast Cable Communications, LLC","not_a_legal_finding":true,"org":"E-interg Ation","peak_day":"2026-08-25","peak_day_events":63,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":262,"sw_events":0,"total_events":265,"unique_ips":12,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":7,"as_name":"AS134366 Cloud Computing HK Limited","asn":"AS134366","asn_org":"Cloud Computing HK Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Yunify Technologies Inc","not_a_legal_finding":true,"org":"Yunify Technologies Inc.","peak_day":"2026-08-21","peak_day_events":62,"share_bh":0.0,"share_ssh":97.6,"share_sw":0.0,"ssh_events":123,"sw_events":0,"total_events":126,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS4788 TM TECHNOLOGY SERVICES SDN. BHD.","asn":"AS4788","asn_org":"TM TECHNOLOGY SERVICES SDN. BHD.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Telekom Malaysia Berhad","not_a_legal_finding":true,"org":"Unifi Home","peak_day":"2026-08-21","peak_day_events":62,"share_bh":0.0,"share_ssh":99.1,"share_sw":0.0,"ssh_events":115,"sw_events":0,"total_events":116,"unique_ips":8,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":15,"as_name":"AS35100 Patrik Lagerman","asn":"AS35100","asn_org":"Patrik Lagerman","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Patrik Lagerman","not_a_legal_finding":true,"org":"Kronnet","peak_day":"2026-08-12","peak_day_events":61,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":232,"sw_events":0,"total_events":236,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS1257 Tele2 Sverige AB","asn":"AS1257","asn_org":"Tele2 Sverige AB","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Tele2 Sverige AB","not_a_legal_finding":true,"org":"Tele2 AB","peak_day":"2026-08-16","peak_day_events":61,"share_bh":0.0,"share_ssh":96.9,"share_sw":0.0,"ssh_events":62,"sw_events":0,"total_events":64,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS42831 UK Dedicated Servers Limited","asn":"AS42831","asn_org":"UK Dedicated Servers Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"UK Dedicated Servers Limited","not_a_legal_finding":true,"org":"Ipxo","peak_day":"2026-08-13","peak_day_events":61,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":61,"sw_events":0,"total_events":61,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS2527 Sony Network Communications Inc.","asn":"AS2527","asn_org":"Sony Network Communications Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"So-net Entertainment Corporation","not_a_legal_finding":true,"org":"So-net Entertainment Corporation","peak_day":"2026-08-12","peak_day_events":60,"share_bh":0.0,"share_ssh":98.4,"share_sw":0.0,"ssh_events":60,"sw_events":0,"total_events":61,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS140726 UNICOM AnHui province network","asn":"AS140726","asn_org":"UNICOM AnHui province network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"China Unicom Network","not_a_legal_finding":true,"org":"","peak_day":"2026-08-11","peak_day_events":60,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":60,"sw_events":0,"total_events":60,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS28006 CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP","asn":"AS28006","asn_org":"CORPORACION NACIONAL DE TELECOMUNICACIONES - CNT EP","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Corporacion Nacional De Telecomunicaciones - CNT EP","not_a_legal_finding":true,"org":"Hospital Psiquiatrico Julio Endara M","peak_day":"2026-09-21","peak_day_events":59,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":124,"sw_events":0,"total_events":124,"unique_ips":10,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":1,"as_name":"AS38744 AlwaysOn Network Bangladesh Ltd","asn":"AS38744","asn_org":"AlwaysOn Network Bangladesh Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Always On Network Bangladesh Ltd.","not_a_legal_finding":true,"org":"Always On Network Bangladesh Ltd","peak_day":"2026-08-15","peak_day_events":58,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":58,"sw_events":0,"total_events":58,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":29,"as_name":"AS7552 Viettel Group","asn":"AS7552","asn_org":"Viettel Group","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Viettel Group","not_a_legal_finding":true,"org":"xDSL Services","peak_day":"2026-08-22","peak_day_events":57,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":439,"sw_events":0,"total_events":444,"unique_ips":36,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":26,"as_name":"AS7713 PT Telekomunikasi Indonesia","asn":"AS7713","asn_org":"PT Telekomunikasi Indonesia","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Telekomunikasi Indonesia","not_a_legal_finding":true,"org":"Temporary","peak_day":"2026-09-10","peak_day_events":57,"share_bh":0.0,"share_ssh":97.9,"share_sw":0.0,"ssh_events":419,"sw_events":0,"total_events":428,"unique_ips":17,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":17,"as_name":"AS24940 Hetzner Online GmbH","asn":"AS24940","asn_org":"Hetzner Online GmbH","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Hetzner Online GmbH","not_a_legal_finding":true,"org":"iServices4u   CERO COMPUTER","peak_day":"2026-09-10","peak_day_events":57,"share_bh":0.0,"share_ssh":95.6,"share_sw":0.0,"ssh_events":239,"sw_events":0,"total_events":250,"unique_ips":53,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":4,"as_name":"AS17639 Converge ICT Solutions Inc.","asn":"AS17639","asn_org":"Converge ICT Solutions Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Converge Information and Communications Technology Solutions","not_a_legal_finding":true,"org":"Converge ICT Solution Inc","peak_day":"2026-08-17","peak_day_events":57,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":72,"sw_events":0,"total_events":72,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS9269 Hong Kong Broadband Network Ltd.","asn":"AS9269","asn_org":"Hong Kong Broadband Network Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Hong Kong Broadband Network Ltd","not_a_legal_finding":true,"org":"Pose21","peak_day":"2026-08-15","peak_day_events":56,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":113,"sw_events":0,"total_events":113,"unique_ips":4,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":2,"as_name":"AS42455 ELITE GROUP.IM LIMITED","asn":"AS42455","asn_org":"ELITE GROUP.IM LIMITED","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Wi-Manx Ltd","not_a_legal_finding":true,"org":"Wi-Manx Limited","peak_day":"2026-08-16","peak_day_events":56,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":107,"sw_events":0,"total_events":107,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":16,"as_name":"AS12389 PJSC Rostelecom","asn":"AS12389","asn_org":"PJSC Rostelecom","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"SPBNIT","not_a_legal_finding":true,"org":"Webstream","peak_day":"2026-09-21","peak_day_events":55,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":206,"sw_events":0,"total_events":209,"unique_ips":18,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":7,"as_name":"AS9930 TTNET","asn":"AS9930","asn_org":"TTNET","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"TTDOTCOM","not_a_legal_finding":true,"org":"","peak_day":"2026-08-17","peak_day_events":54,"share_bh":0.0,"share_ssh":98.0,"share_sw":0.0,"ssh_events":148,"sw_events":0,"total_events":151,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":7,"as_name":"AS9299 Philippine Long Distance Telephone Company","asn":"AS9299","asn_org":"Philippine Long Distance Telephone Company","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Philippine Long Distance Telephone Co.","not_a_legal_finding":true,"org":"Philippine Long Distance Telephone Company","peak_day":"2026-09-21","peak_day_events":53,"share_bh":0.0,"share_ssh":99.4,"share_sw":0.0,"ssh_events":154,"sw_events":0,"total_events":155,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":11,"as_name":"AS204428 SS-Net","asn":"AS204428","asn_org":"SS-Net","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"SS-Net","not_a_legal_finding":true,"org":"Unmanaged LTD","peak_day":"2026-09-14","peak_day_events":52,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":274,"sw_events":0,"total_events":274,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS18403 FPT Telecom Company","asn":"AS18403","asn_org":"FPT Telecom Company","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Vietnam Internet Network Information Center","not_a_legal_finding":true,"org":"Vietnam Internet Network Information Center","peak_day":"2026-09-21","peak_day_events":52,"share_bh":0.0,"share_ssh":98.4,"share_sw":0.0,"ssh_events":179,"sw_events":0,"total_events":182,"unique_ips":13,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":12,"as_name":"AS7303 Telecom Argentina S.A.","asn":"AS7303","asn_org":"Telecom Argentina S.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Telecom Argentina S.A.","not_a_legal_finding":true,"org":"Telecom Personal Bs","peak_day":"2026-08-12","peak_day_events":51,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":225,"sw_events":0,"total_events":229,"unique_ips":8,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":2,"as_name":"AS44489 STARNET, s.r.o.","asn":"AS44489","asn_org":"STARNET, s.r.o.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Starnet s.r.o","not_a_legal_finding":true,"org":"Starnet s.r.o.","peak_day":"2026-08-12","peak_day_events":51,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":55,"sw_events":0,"total_events":55,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS41745 Baykov Ilya Sergeevich","asn":"AS41745","asn_org":"Baykov Ilya Sergeevich","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Baykov Ilya Sergeevich","not_a_legal_finding":true,"org":"Baykov Ilya Sergeevich","peak_day":"2026-08-13","peak_day_events":51,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":52,"sw_events":0,"total_events":52,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS6568 EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA","asn":"AS6568","asn_org":"EMPRESA NACIONAL DE TELECOMUNICACIONES SOCIEDAD ANONIMA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Entel S.A. - EntelNet","not_a_legal_finding":true,"org":"Empresa Nacional De Telecomunicaciones Sociedad Anonima","peak_day":"2026-08-12","peak_day_events":50,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":171,"sw_events":0,"total_events":174,"unique_ips":6,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":12,"as_name":"AS17451 BIZNET NETWORKS","asn":"AS17451","asn_org":"BIZNET NETWORKS","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Biznet Networks","not_a_legal_finding":true,"org":"PT Teckindo Prima Gemilang Jaya","peak_day":"2026-09-21","peak_day_events":50,"share_bh":0.0,"share_ssh":94.9,"share_sw":0.0,"ssh_events":130,"sw_events":0,"total_events":137,"unique_ips":11,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":17,"as_name":"AS45899 VNPT Corp","asn":"AS45899","asn_org":"VNPT Corp","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"VietNam Post and Telecom Corporation","not_a_legal_finding":true,"org":"Vietnam Posts and Telecommunications Group","peak_day":"2026-08-25","peak_day_events":49,"share_bh":0.0,"share_ssh":99.6,"share_sw":0.0,"ssh_events":281,"sw_events":0,"total_events":282,"unique_ips":26,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":8,"as_name":"AS14670 WHG Hosting Services Ltd","asn":"AS14670","asn_org":"WHG Hosting Services Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"ipxo","not_a_legal_finding":true,"org":"Private Customer","peak_day":"2026-09-10","peak_day_events":49,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":115,"sw_events":0,"total_events":115,"unique_ips":12,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS34984 Superonline Iletisim Hizmetleri A.S.","asn":"AS34984","asn_org":"Superonline Iletisim Hizmetleri A.S.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Superonline Iletisim Hizmetleri A.S.","not_a_legal_finding":true,"org":"Yonnet Bilisim Yazilim Egitim VE Danismanlik Hizmetleri","peak_day":"2026-09-10","peak_day_events":49,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":88,"sw_events":0,"total_events":88,"unique_ips":6,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":7,"as_name":"AS17621 China Unicom Shanghai network","asn":"AS17621","asn_org":"China Unicom Shanghai network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"UCLOUD","not_a_legal_finding":true,"org":"Shanghai UCloud Information Technology Company Limited","peak_day":"2026-08-20","peak_day_events":49,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":74,"sw_events":0,"total_events":74,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":20,"as_name":"AS8151 Uninet S.A. de C.V.","asn":"AS8151","asn_org":"Uninet S.A. de C.V.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Uninet S.A. de C.V.","not_a_legal_finding":true,"org":"Uninet S.A. de C.V.","peak_day":"2026-09-06","peak_day_events":45,"share_bh":0.0,"share_ssh":99.1,"share_sw":0.0,"ssh_events":439,"sw_events":0,"total_events":443,"unique_ips":24,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":16,"as_name":"AS7488 CNServer LLC","asn":"AS7488","asn_org":"CNServer LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"CNServer LLC","not_a_legal_finding":true,"org":"Securewan","peak_day":"2026-10-08","peak_day_events":45,"share_bh":0.0,"share_ssh":94.2,"share_sw":0.0,"ssh_events":194,"sw_events":0,"total_events":206,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":9,"as_name":"AS680 Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.","asn":"AS680","asn_org":"Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Verein zur Foerderung eines Deutschen Forschungsnetzes e.V.","not_a_legal_finding":true,"org":"Mpii NET 117 Inet","peak_day":"2026-08-14","peak_day_events":44,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":360,"sw_events":0,"total_events":360,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":15,"as_name":"AS53667 FranTech Solutions","asn":"AS53667","asn_org":"FranTech Solutions","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"FranTech Solutions","not_a_legal_finding":true,"org":"FranTech Solutions","peak_day":"2026-08-28","peak_day_events":44,"share_bh":0.0,"share_ssh":97.2,"share_sw":0.0,"ssh_events":209,"sw_events":0,"total_events":215,"unique_ips":9,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":10,"as_name":"AS15830 Equinix (EMEA) Acquisition Enterprises B.V.","asn":"AS15830","asn_org":"Equinix (EMEA) Acquisition Enterprises B.V.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Equinix Brasil","not_a_legal_finding":true,"org":"Equinix Brasil","peak_day":"2026-08-16","peak_day_events":44,"share_bh":0.0,"share_ssh":99.4,"share_sw":0.0,"ssh_events":157,"sw_events":0,"total_events":158,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS8346 SONATEL-AS Autonomous System","asn":"AS8346","asn_org":"SONATEL-AS Autonomous System","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Sonatel","not_a_legal_finding":true,"org":"Isercom Saint louis","peak_day":"2026-08-13","peak_day_events":44,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":72,"sw_events":0,"total_events":73,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS3257 GTT Communications Inc.","asn":"AS3257","asn_org":"GTT Communications Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"GTT Communications Inc.","not_a_legal_finding":true,"org":"IPXO","peak_day":"2026-08-19","peak_day_events":43,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":43,"sw_events":0,"total_events":43,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS207713 GLOBAL INTERNET SOLUTIONS LLC","asn":"AS207713","asn_org":"GLOBAL INTERNET SOLUTIONS LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Global Internet Solutions LLC","not_a_legal_finding":true,"org":"Global Internet Solutions LLC","peak_day":"2026-08-18","peak_day_events":42,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":57,"sw_events":0,"total_events":57,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS8193 Uzbektelekom Joint Stock Company","asn":"AS8193","asn_org":"Uzbektelekom Joint Stock Company","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"\"Uzbektelekom\" Joint Stock Company","not_a_legal_finding":true,"org":"Uztelecom","peak_day":"2026-08-19","peak_day_events":41,"share_bh":0.0,"share_ssh":95.4,"share_sw":0.0,"ssh_events":62,"sw_events":0,"total_events":65,"unique_ips":2,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":9,"as_name":"AS131353 NhanHoa Software company","asn":"AS131353","asn_org":"NhanHoa Software company","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"NhanHoa Software company","not_a_legal_finding":true,"org":"Nhan HOA Business Solutions Joint Stock Company","peak_day":"2026-09-10","peak_day_events":39,"share_bh":0.0,"share_ssh":99.2,"share_sw":0.0,"ssh_events":127,"sw_events":0,"total_events":128,"unique_ips":25,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS271717 Comnet Internet Matel\u00e2ndia Ltda","asn":"AS271717","asn_org":"Comnet Internet Matel\u00e2ndia Ltda","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Comnet Internet Matel\u00e2ndia Ltda","not_a_legal_finding":true,"org":"Comnet Internet Matel\u00e2ndia Ltda","peak_day":"2026-08-12","peak_day_events":39,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":104,"sw_events":0,"total_events":104,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":14,"as_name":"AS60077 Asre Dadeha Asiatech","asn":"AS60077","asn_org":"Asre Dadeha Asiatech","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"ASIATECH","not_a_legal_finding":true,"org":"","peak_day":"2026-10-06","peak_day_events":38,"share_bh":0.0,"share_ssh":98.2,"share_sw":0.0,"ssh_events":218,"sw_events":0,"total_events":222,"unique_ips":6,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":16,"as_name":"AS4811 China Telecom (Group)","asn":"AS4811","asn_org":"China Telecom (Group)","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"China Telecom (Group)","not_a_legal_finding":true,"org":"Webmaster Technology Developing Co., Ltd.","peak_day":"2026-08-18","peak_day_events":38,"share_bh":0.0,"share_ssh":97.7,"share_sw":0.0,"ssh_events":172,"sw_events":0,"total_events":176,"unique_ips":13,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":5,"as_name":"AS140810 Megacore Technology Company Limited","asn":"AS140810","asn_org":"Megacore Technology Company Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Royal Technology Media Joint Stock Company","not_a_legal_finding":true,"org":"Royal Technology Media Joint Stock Company","peak_day":"2026-08-19","peak_day_events":38,"share_bh":0.0,"share_ssh":96.9,"share_sw":0.0,"ssh_events":63,"sw_events":0,"total_events":65,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS396377 fastCLOUD","asn":"AS396377","asn_org":"fastCLOUD","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Liberty Mobile Puerto Rico Inc.","not_a_legal_finding":true,"org":"FASTC-9","peak_day":"2026-09-10","peak_day_events":38,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":50,"sw_events":0,"total_events":50,"unique_ips":3,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":16,"as_name":"AS38700 SMILESERV","asn":"AS38700","asn_org":"SMILESERV","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"SMILESERV","not_a_legal_finding":true,"org":"SMILESERV","peak_day":"2026-08-24","peak_day_events":37,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":235,"sw_events":0,"total_events":239,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":30,"as_name":"AS215929 Data Campus Limited","asn":"AS215929","asn_org":"Data Campus Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Data Campus Limited","not_a_legal_finding":true,"org":"Data Campus Limited","peak_day":"2026-08-12","peak_day_events":37,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":133,"sw_events":0,"total_events":133,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":12,"as_name":"AS210006 Shereverov Marat Ahmedovich","asn":"AS210006","asn_org":"Shereverov Marat Ahmedovich","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Shereverov Marat Ahmedovich","not_a_legal_finding":true,"org":"Nikolov Dimitrov Georgi","peak_day":"2026-08-13","peak_day_events":37,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":129,"sw_events":0,"total_events":129,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS9329 Sri Lanka Telecom Internet","asn":"AS9329","asn_org":"Sri Lanka Telecom Internet","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Sri Lanka Telecom Ltd","not_a_legal_finding":true,"org":"","peak_day":"2026-08-20","peak_day_events":37,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":114,"sw_events":0,"total_events":116,"unique_ips":1,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":3,"as_name":"AS139021 West263 International Limited","asn":"AS139021","asn_org":"West263 International Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"West263 International Limited","not_a_legal_finding":true,"org":"Zhongya PTE LTD","peak_day":"2026-08-16","peak_day_events":37,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":47,"sw_events":0,"total_events":47,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS36007 Kamatera, Inc.","asn":"AS36007","asn_org":"Kamatera, Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Kamatera, Inc.","not_a_legal_finding":true,"org":"Cloud Web Manage","peak_day":"2026-08-15","peak_day_events":37,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":44,"sw_events":0,"total_events":44,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS23951 PT JEMBATAN CITRA NUSANTARA","asn":"AS23951","asn_org":"PT JEMBATAN CITRA NUSANTARA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PT Jembatan Citra Nusantara","not_a_legal_finding":true,"org":"","peak_day":"2026-08-16","peak_day_events":37,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":42,"sw_events":0,"total_events":42,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":26,"as_name":"AS3216 PJSC Vimpelcom","asn":"AS3216","asn_org":"PJSC Vimpelcom","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Sovam Teleport","not_a_legal_finding":true,"org":"Stnet","peak_day":"2026-08-13","peak_day_events":36,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":142,"sw_events":0,"total_events":144,"unique_ips":10,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":11,"as_name":"AS131423 Branch of Long Van System Solution JSC - Hanoi","asn":"AS131423","asn_org":"Branch of Long Van System Solution JSC - Hanoi","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Vietnam Internet Network Information Center","not_a_legal_finding":true,"org":"JSC - Hanoi","peak_day":"2026-08-17","peak_day_events":36,"share_bh":0.0,"share_ssh":96.9,"share_sw":0.0,"ssh_events":123,"sw_events":0,"total_events":127,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS49720 Gigacloud LLC","asn":"AS49720","asn_org":"Gigacloud LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"OpenStack","not_a_legal_finding":true,"org":"Gigacloud LLC","peak_day":"2026-09-10","peak_day_events":36,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":87,"sw_events":0,"total_events":87,"unique_ips":9,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS263238 Eliana Vanessa Morocho O\u00f1a","asn":"AS263238","asn_org":"Eliana Vanessa Morocho O\u00f1a","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Eliana Vanessa Morocho O\u00f1a","not_a_legal_finding":true,"org":"Universal-stereo C.L","peak_day":"2026-08-13","peak_day_events":36,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":65,"sw_events":0,"total_events":65,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS136336 Thamizhaga Internet Communications Private Limited","asn":"AS136336","asn_org":"Thamizhaga Internet Communications Private Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Thamizhaga Internet Communications Private Limited","not_a_legal_finding":true,"org":"Thamizhaga Internet Communications Private Limited","peak_day":"2026-08-16","peak_day_events":36,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":53,"sw_events":0,"total_events":53,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS58854 Kaopu Cloud","asn":"AS58854","asn_org":"Kaopu Cloud","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"kaopy","not_a_legal_finding":true,"org":"Kaopy","peak_day":"2026-08-13","peak_day_events":36,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":36,"sw_events":0,"total_events":36,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS26210 AXS Bolivia S. A.","asn":"AS26210","asn_org":"AXS Bolivia S. A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"AXS Bolivia S. A.","not_a_legal_finding":true,"org":"AXS Bolivia S. A","peak_day":"2026-08-17","peak_day_events":35,"share_bh":0.0,"share_ssh":99.4,"share_sw":0.0,"ssh_events":157,"sw_events":0,"total_events":158,"unique_ips":8,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS3209 Vodafone GmbH","asn":"AS3209","asn_org":"Vodafone GmbH","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Vodafone Kabel Deutschland","not_a_legal_finding":true,"org":"Vodafone NRW GmbH","peak_day":"2026-08-15","peak_day_events":35,"share_bh":0.0,"share_ssh":98.7,"share_sw":0.0,"ssh_events":151,"sw_events":0,"total_events":153,"unique_ips":6,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS200845 AVATEL TELECOM, SA","asn":"AS200845","asn_org":"AVATEL TELECOM, SA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"URFO3","not_a_legal_finding":true,"org":"","peak_day":"2026-09-04","peak_day_events":35,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":72,"sw_events":0,"total_events":73,"unique_ips":1,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":6,"as_name":"AS8359 MTS PJSC","asn":"AS8359","asn_org":"MTS PJSC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Rostov-GSPD","not_a_legal_finding":true,"org":"Mobile Telesystems OJSC","peak_day":"2026-09-10","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":69,"sw_events":0,"total_events":69,"unique_ips":7,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":5,"as_name":"AS37100 SEACOM Limited","asn":"AS37100","asn_org":"SEACOM Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"SEACOM Limited Networks","not_a_legal_finding":true,"org":"","peak_day":"2026-08-19","peak_day_events":35,"share_bh":0.0,"share_ssh":97.1,"share_sw":0.0,"ssh_events":66,"sw_events":0,"total_events":68,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS136897 Enjoyvc Cloud Group Limited.","asn":"AS136897","asn_org":"Enjoyvc Cloud Group Limited.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Enjoyvc Cloud Group Limited","not_a_legal_finding":true,"org":"Enjoyvc Cloud Group Limited","peak_day":"2026-08-22","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":66,"sw_events":0,"total_events":66,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS1267 WIND TRE S.P.A.","asn":"AS1267","asn_org":"WIND TRE S.P.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Wind TRE S.P.A","not_a_legal_finding":true,"org":"INFOSTRADA","peak_day":"2026-08-27","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":61,"sw_events":0,"total_events":61,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS59257 CMPak Limited","asn":"AS59257","asn_org":"CMPak Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"CMPak Limited","not_a_legal_finding":true,"org":"CMPak Mobile Fixed Network","peak_day":"2026-08-20","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":55,"sw_events":0,"total_events":55,"unique_ips":2,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":2,"as_name":"AS214481 Wojciech Czapkowicz","asn":"AS214481","asn_org":"Wojciech Czapkowicz","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Wojciech Czapkowicz","not_a_legal_finding":true,"org":"TABS-HOSTING","peak_day":"2026-08-15","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":40,"sw_events":0,"total_events":40,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS49100 Pishgaman Toseeh Ertebatat Company (Private Joint Stock)","asn":"AS49100","asn_org":"Pishgaman Toseeh Ertebatat Company (Private Joint Stock)","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PTS-Network","not_a_legal_finding":true,"org":"","peak_day":"2026-08-22","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":39,"sw_events":0,"total_events":39,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS48441 MagLAN LLC","asn":"AS48441","asn_org":"MagLAN LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"MAGLAN","not_a_legal_finding":true,"org":"","peak_day":"2026-08-18","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":35,"sw_events":0,"total_events":35,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS5065 Bunny Communications","asn":"AS5065","asn_org":"Bunny Communications","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Bunny Communications","not_a_legal_finding":true,"org":"","peak_day":"2026-08-14","peak_day_events":35,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":35,"sw_events":0,"total_events":35,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS211056 Amir Hosein Maaref","asn":"AS211056","asn_org":"Amir Hosein Maaref","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Amir Hosein Maaref","not_a_legal_finding":true,"org":"ManaServer","peak_day":"2026-08-13","peak_day_events":34,"share_bh":0.0,"share_ssh":96.7,"share_sw":0.0,"ssh_events":119,"sw_events":0,"total_events":123,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS50482 JSC Kazakhtelecom","asn":"AS50482","asn_org":"JSC Kazakhtelecom","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Kazakhtelecom Data Network Administration","not_a_legal_finding":true,"org":"Co-location, LLC","peak_day":"2026-08-20","peak_day_events":34,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":93,"sw_events":0,"total_events":94,"unique_ips":2,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":4,"as_name":"AS28573 Claro NXT Telecomunicacoes Ltda","asn":"AS28573","asn_org":"Claro NXT Telecomunicacoes Ltda","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Claro NXT Telecomunicacoes Ltda","not_a_legal_finding":true,"org":"Claro NXT Telecomunicacoes Ltda","peak_day":"2026-08-29","peak_day_events":34,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":85,"sw_events":0,"total_events":85,"unique_ips":4,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":16,"as_name":"AS42610 OJSC National Cable Networks","asn":"AS42610","asn_org":"OJSC National Cable Networks","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"National Cable Networks","not_a_legal_finding":true,"org":"","peak_day":"2026-08-15","peak_day_events":34,"share_bh":0.0,"share_ssh":97.4,"share_sw":0.0,"ssh_events":75,"sw_events":0,"total_events":77,"unique_ips":6,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS134768 CHINANET SHAANXI province Cloud Base network","asn":"AS134768","asn_org":"CHINANET SHAANXI province Cloud Base network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"CHINANET SHAANXI province Cloud Base network","not_a_legal_finding":true,"org":"Chinanet SN","peak_day":"2026-08-22","peak_day_events":34,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":44,"sw_events":0,"total_events":44,"unique_ips":3,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":2,"as_name":"AS210022 Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.","asn":"AS210022","asn_org":"Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Trade Link Logistics General Trading & Contracting Company W.L.L., L.L.C.","not_a_legal_finding":true,"org":"","peak_day":"2026-08-13","peak_day_events":34,"share_bh":0.0,"share_ssh":97.5,"share_sw":0.0,"ssh_events":39,"sw_events":0,"total_events":40,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS27648 TELECOMUNICACIONES BANTEL, C.A.","asn":"AS27648","asn_org":"TELECOMUNICACIONES BANTEL, C.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"TELECOMUNICACIONES BANTEL, C.A.","not_a_legal_finding":true,"org":"TELECOMUNICACIONES BANTEL, C.A","peak_day":"2026-08-17","peak_day_events":34,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":34,"sw_events":0,"total_events":34,"unique_ips":1,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":25,"as_name":"AS142403 YISU CLOUD LTD","asn":"AS142403","asn_org":"YISU CLOUD LTD","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Yisu Cloud LTD","not_a_legal_finding":true,"org":"Yisu Cloud Ltd","peak_day":"2026-08-19","peak_day_events":33,"share_bh":0.0,"share_ssh":97.3,"share_sw":0.0,"ssh_events":326,"sw_events":0,"total_events":335,"unique_ips":12,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":12,"as_name":"AS8151 UNINET","asn":"AS8151","asn_org":"UNINET","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"UNINET","not_a_legal_finding":true,"org":"Uninet S.A. de C.V.","peak_day":"2026-08-12","peak_day_events":33,"share_bh":0.0,"share_ssh":98.9,"share_sw":0.0,"ssh_events":173,"sw_events":0,"total_events":175,"unique_ips":8,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":9,"as_name":"AS140641 YOTTA NETWORK SERVICES PRIVATE LIMITED","asn":"AS140641","asn_org":"YOTTA NETWORK SERVICES PRIVATE LIMITED","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Yotta Network Services Private Limited","not_a_legal_finding":true,"org":"Yotta Network Services Private Limited","peak_day":"2026-08-14","peak_day_events":33,"share_bh":0.0,"share_ssh":97.8,"share_sw":0.0,"ssh_events":132,"sw_events":0,"total_events":135,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS212552 BitCommand LLC","asn":"AS212552","asn_org":"BitCommand LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"BitCommand LLC","not_a_legal_finding":true,"org":"Parsun Network Solutions PTY LTD","peak_day":"2026-08-13","peak_day_events":33,"share_bh":0.0,"share_ssh":96.1,"share_sw":0.0,"ssh_events":74,"sw_events":0,"total_events":77,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS26599 TELEF\u00d4NICA BRASIL S.A","asn":"AS26599","asn_org":"TELEF\u00d4NICA BRASIL S.A","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Vivo","not_a_legal_finding":true,"org":"TELEF\ufffdNICA BRASIL S.A","peak_day":"2026-09-05","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":72,"sw_events":0,"total_events":72,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS135834 Multicraft Digital Technologies Private Limited","asn":"AS135834","asn_org":"Multicraft Digital Technologies Private Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Peering Exchange Inc","not_a_legal_finding":true,"org":"Peering Exchange Inc","peak_day":"2026-08-17","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":67,"sw_events":0,"total_events":67,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":7,"as_name":"AS2516 KDDI CORPORATION","asn":"AS2516","asn_org":"KDDI CORPORATION","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Kddi Corporation","not_a_legal_finding":true,"org":"Kddi Corporation","peak_day":"2026-08-18","peak_day_events":33,"share_bh":0.0,"share_ssh":98.5,"share_sw":0.0,"ssh_events":65,"sw_events":0,"total_events":66,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS23201 Telecel S.A.","asn":"AS23201","asn_org":"Telecel S.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Telecel S.A.","not_a_legal_finding":true,"org":"Telecel S.A","peak_day":"2026-09-21","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":65,"sw_events":0,"total_events":65,"unique_ips":7,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS215590 DpkgSoft International Limited","asn":"AS215590","asn_org":"DpkgSoft International Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"DpkgSoft International Limited","not_a_legal_finding":true,"org":"Xorek.Cloud Frankfurt","peak_day":"2026-08-16","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":61,"sw_events":0,"total_events":61,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS12252 America Movil Peru S.A.C.","asn":"AS12252","asn_org":"America Movil Peru S.A.C.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"America Movil Peru S.A.C.","not_a_legal_finding":true,"org":"America Movil Peru S.A.C","peak_day":"2026-08-15","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":59,"sw_events":0,"total_events":59,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS17882 Univision LLC","asn":"AS17882","asn_org":"Univision LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"MCS Com Co Ltd","not_a_legal_finding":true,"org":"Univision LLC","peak_day":"2026-08-19","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":56,"sw_events":0,"total_events":56,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS20001 Charter Communications Inc","asn":"AS20001","asn_org":"Charter Communications Inc","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Spectrum","not_a_legal_finding":true,"org":"Road Runner, VoIP Residential","peak_day":"2026-08-26","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":52,"sw_events":0,"total_events":52,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS52207 JSC ER-Telecom Holding","asn":"AS52207","asn_org":"JSC ER-Telecom Holding","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"JSC \"ER-Telecom Holding\"","not_a_legal_finding":true,"org":"CJSC \"ER-Telecom Holding\" Tula Branch","peak_day":"2026-08-15","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":44,"sw_events":0,"total_events":44,"unique_ips":1,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":4,"as_name":"AS401701 cognetcloud INC","asn":"AS401701","asn_org":"cognetcloud INC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"cognetcloud INC","not_a_legal_finding":true,"org":"HUANGYUN","peak_day":"2026-08-17","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":40,"sw_events":0,"total_events":40,"unique_ips":3,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS40065 CNSERVERS LLC","asn":"AS40065","asn_org":"CNSERVERS LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Cnservers LLC","not_a_legal_finding":true,"org":"Shatin","peak_day":"2026-08-14","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":39,"sw_events":0,"total_events":39,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS17623 China Unicom Shenzen network","asn":"AS17623","asn_org":"China Unicom Shenzen network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"China Unicom Guangdong Province Network","not_a_legal_finding":true,"org":"","peak_day":"2026-08-14","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":38,"sw_events":0,"total_events":38,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS8595 OOO WestCall Ltd.","asn":"AS8595","asn_org":"OOO WestCall Ltd.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"OOO WestCall Ltd","not_a_legal_finding":true,"org":"WestCall Ltd","peak_day":"2026-08-14","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":34,"sw_events":0,"total_events":34,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":1,"as_name":"AS18126 Chubu Telecommunications Company, Inc.","asn":"AS18126","asn_org":"Chubu Telecommunications Company, Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Chubu Telecommunications Co., Inc.","not_a_legal_finding":true,"org":"General placeholder reference all addresses","peak_day":"2026-08-17","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":33,"sw_events":0,"total_events":33,"unique_ips":1,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":1,"as_name":"AS329394 OneCloud LDA","asn":"AS329394","asn_org":"OneCloud LDA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Icolo Main DC","not_a_legal_finding":true,"org":"","peak_day":"2026-08-13","peak_day_events":33,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":33,"sw_events":0,"total_events":33,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":28,"as_name":"AS3462 Data Communication Business Group","asn":"AS3462","asn_org":"Data Communication Business Group","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Chunghwa Telecom Co., Ltd.","not_a_legal_finding":true,"org":"Chunghwa Telecom Co. Ltd.","peak_day":"2026-08-23","peak_day_events":32,"share_bh":0.0,"share_ssh":94.6,"share_sw":0.0,"ssh_events":280,"sw_events":0,"total_events":296,"unique_ips":23,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":17,"as_name":"AS19871 Network Solutions, LLC","asn":"AS19871","asn_org":"Network Solutions, LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"WEBSITEWELCOME.COM","not_a_legal_finding":true,"org":"one.onegay.net","peak_day":"2026-08-17","peak_day_events":32,"share_bh":0.0,"share_ssh":99.0,"share_sw":0.0,"ssh_events":204,"sw_events":0,"total_events":206,"unique_ips":13,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":13,"as_name":"AS14956 RouterHosting LLC","asn":"AS14956","asn_org":"RouterHosting LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"RouterHosting LLC","not_a_legal_finding":true,"org":"anyNode","peak_day":"2026-08-16","peak_day_events":32,"share_bh":0.0,"share_ssh":96.4,"share_sw":0.0,"ssh_events":108,"sw_events":0,"total_events":112,"unique_ips":9,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS45117 Ishan's Network","asn":"AS45117","asn_org":"Ishan's Network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Ishan's Network","not_a_legal_finding":true,"org":"NIXI","peak_day":"2026-08-16","peak_day_events":32,"share_bh":0.0,"share_ssh":99.0,"share_sw":0.0,"ssh_events":104,"sw_events":0,"total_events":105,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":7,"as_name":"AS4761 INDOSAT Internet Network Provider","asn":"AS4761","asn_org":"INDOSAT Internet Network Provider","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PT. INDOSAT Tbk","not_a_legal_finding":true,"org":"IOH B2B","peak_day":"2026-08-21","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":105,"sw_events":0,"total_events":105,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS28330 IFTNET-TELECOM","asn":"AS28330","asn_org":"IFTNET-TELECOM","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"IFTNET Telecomunicacoes Ltda","not_a_legal_finding":true,"org":"Samm Tecnologia E Telecomunicacoes S.A","peak_day":"2026-09-11","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":95,"sw_events":0,"total_events":95,"unique_ips":2,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":6,"as_name":"AS262826 PW INFORMATICA E TECNOLOGIA LTDA","asn":"AS262826","asn_org":"PW INFORMATICA E TECNOLOGIA LTDA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"PW INFORMATICA E TECNOLOGIA LTDA","not_a_legal_finding":true,"org":"PW INFORMATICA E TECNOLOGIA LTDA","peak_day":"2026-08-18","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":83,"sw_events":0,"total_events":83,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS54994 Meteverse Limited.","asn":"AS54994","asn_org":"Meteverse Limited.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Meteverse Limited.","not_a_legal_finding":true,"org":"Cdnetworks","peak_day":"2026-08-13","peak_day_events":32,"share_bh":0.0,"share_ssh":96.4,"share_sw":0.0,"ssh_events":80,"sw_events":0,"total_events":83,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS45090 Shenzhen Tencent Computer Systems Company Limited","asn":"AS45090","asn_org":"Shenzhen Tencent Computer Systems Company Limited","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Shenzhen Tencent Computer Systems Company Limited","not_a_legal_finding":true,"org":"Tencent cloud computing (Beijing) Co., Ltd.","peak_day":"2026-08-20","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":77,"sw_events":0,"total_events":77,"unique_ips":7,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":8,"as_name":"AS9891 CS LOXINFO Public Company Limited.","asn":"AS9891","asn_org":"CS LOXINFO Public Company Limited.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"CS Loxinfo Public Company Limited","not_a_legal_finding":true,"org":"Idc Csloxinfo","peak_day":"2026-08-25","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":74,"sw_events":0,"total_events":74,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS36454 WHG Hosting Services Ltd","asn":"AS36454","asn_org":"WHG Hosting Services Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"WHG Hosting Services Ltd","not_a_legal_finding":true,"org":"WHG Hosting Services Ltd","peak_day":"2026-08-14","peak_day_events":32,"share_bh":0.0,"share_ssh":98.6,"share_sw":0.0,"ssh_events":70,"sw_events":0,"total_events":71,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":6,"as_name":"AS16019 Vodafone Czech Republic a.s.","asn":"AS16019","asn_org":"Vodafone Czech Republic a.s.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Vodafone Czech Republic a.s.","not_a_legal_finding":true,"org":"VFCZ-DSL","peak_day":"2026-08-18","peak_day_events":32,"share_bh":0.0,"share_ssh":97.1,"share_sw":0.0,"ssh_events":68,"sw_events":0,"total_events":70,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":5,"as_name":"AS135944 VinhNam Commercial informatics service corporation","asn":"AS135944","asn_org":"VinhNam Commercial informatics service corporation","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"SPT","not_a_legal_finding":true,"org":"Saigon Postel Corporation","peak_day":"2026-08-22","peak_day_events":32,"share_bh":0.0,"share_ssh":95.5,"share_sw":0.0,"ssh_events":64,"sw_events":0,"total_events":67,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS269810 SM COMUNICACIONES S.R.L.","asn":"AS269810","asn_org":"SM COMUNICACIONES S.R.L.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"SM COMUNICACIONES S.R.L.","not_a_legal_finding":true,"org":"SM COMUNICACIONES S.R.L","peak_day":"2026-08-27","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":64,"sw_events":0,"total_events":64,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS23470 ReliableSite.Net LLC","asn":"AS23470","asn_org":"ReliableSite.Net LLC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"ReliableSite.Net LLC","not_a_legal_finding":true,"org":"samuel godbillot","peak_day":"2026-08-13","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":57,"sw_events":0,"total_events":57,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS9441 Next Online Limited.","asn":"AS9441","asn_org":"Next Online Limited.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Next Online Ltd","not_a_legal_finding":true,"org":"Next Online Limited","peak_day":"2026-08-21","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":57,"sw_events":0,"total_events":57,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":4,"as_name":"AS134420 Chongqing Telecom","asn":"AS134420","asn_org":"Chongqing Telecom","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"cloud_vps_host","category_label":"Cloud Vps Host","isp":"Chongqing Telecom","not_a_legal_finding":true,"org":"Chinanet CQ","peak_day":"2026-08-23","peak_day_events":32,"share_bh":0.0,"share_ssh":94.2,"share_sw":0.0,"ssh_events":49,"sw_events":0,"total_events":52,"unique_ips":2,"why_likely":"Cloud/VPS host. Abuse is usually from rented VMs (bots, scanners, compromised tenants), not the host\u2019s own ops desk."},{"active_days":2,"as_name":"AS266603 NEXT FIBRA","asn":"AS266603","asn_org":"NEXT FIBRA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Next Fibra","not_a_legal_finding":true,"org":"Next Fibra","peak_day":"2026-08-21","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":43,"sw_events":0,"total_events":43,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS136958 China Unicom Guangdong IP network","asn":"AS136958","asn_org":"China Unicom Guangdong IP network","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"UCLOUD","not_a_legal_finding":true,"org":"Shanghai UCloud Information Technology Company Limited","peak_day":"2026-08-25","peak_day_events":32,"share_bh":0.0,"share_ssh":97.4,"share_sw":0.0,"ssh_events":38,"sw_events":0,"total_events":39,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":2,"as_name":"AS16591 Google Fiber Inc.","asn":"AS16591","asn_org":"Google Fiber Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"Google Fiber Inc.","not_a_legal_finding":true,"org":"Google Fiber Inc","peak_day":"2026-08-19","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":37,"sw_events":0,"total_events":37,"unique_ips":1,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":3,"as_name":"AS37228 KT RWANDA NETWORK Ltd","asn":"AS37228","asn_org":"KT RWANDA NETWORK Ltd","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"BSC","not_a_legal_finding":true,"org":"","peak_day":"2026-08-14","peak_day_events":32,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":36,"sw_events":0,"total_events":36,"unique_ips":2,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":15,"as_name":"AS24309 Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA","asn":"AS24309","asn_org":"Atria Convergence Technologies Pvt. Ltd. Broadband Internet Service Provider INDIA","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"Atria Convergence Technologies Pvt. Ltd","not_a_legal_finding":true,"org":"Broadband india","peak_day":"2026-08-16","peak_day_events":31,"share_bh":0.0,"share_ssh":98.3,"share_sw":0.0,"ssh_events":170,"sw_events":0,"total_events":173,"unique_ips":8,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."},{"active_days":7,"as_name":"AS58791 GMO Internet, Inc.","asn":"AS58791","asn_org":"GMO Internet, Inc.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"GMO Internet, Inc","not_a_legal_finding":true,"org":"GMO Internet Group, Inc.","peak_day":"2026-08-14","peak_day_events":31,"share_bh":0.0,"share_ssh":100.0,"share_sw":0.0,"ssh_events":119,"sw_events":0,"total_events":119,"unique_ips":5,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":9,"as_name":"AS17995 PT iForte Global Internet","asn":"AS17995","asn_org":"PT iForte Global Internet","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"SOLUSINET","not_a_legal_finding":true,"org":"Solusinet","peak_day":"2026-08-18","peak_day_events":31,"share_bh":0.0,"share_ssh":98.1,"share_sw":0.0,"ssh_events":106,"sw_events":0,"total_events":108,"unique_ips":6,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":9,"as_name":"AS131386 Long Van System Solution JSC","asn":"AS131386","asn_org":"Long Van System Solution JSC","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"unknown_network","category_label":"Unknown Network","isp":"MAXDATA","not_a_legal_finding":true,"org":"Lvss","peak_day":"2026-08-13","peak_day_events":31,"share_bh":0.0,"share_ssh":98.0,"share_sw":0.0,"ssh_events":97,"sw_events":0,"total_events":99,"unique_ips":4,"why_likely":"No strong brand match. Treat as upstream network for whoever currently holds the IPs \u2014 compromised hosts, rented VPS, or opportunistic scanners are the usual explanations."},{"active_days":8,"as_name":"AS13489 UNE EPM TELECOMUNICACIONES S.A.","asn":"AS13489","asn_org":"UNE EPM TELECOMUNICACIONES S.A.","behavior_notes":["Material real sshd (:22) failures \u2014 credential stuffing / brute style against production SSH."],"bh_events":0,"category":"isp_access","category_label":"Isp Access","isp":"UNE EPM TELECOMUNICACIONES S.A","not_a_legal_finding":true,"org":"UNE EPM TELECOMUNICACIONES S.A","peak_day":"2026-08-16","peak_day_events":31,"share_bh":0.0,"share_ssh":94.9,"share_sw":0.0,"ssh_events":93,"sw_events":0,"total_events":98,"unique_ips":8,"why_likely":"Access ISP. Often residential/CGNAT; individual subscribers or infected home devices, not a company campaign."}],"categories":{"bigtech_cloud_or_security":2,"bulletproof_or_abuse_friendly_hosting":1,"cloud_vps_host":14,"isp_access":38,"research_education":1,"unknown_network":144},"count":200,"filter_host":"all","notes":["Listed when any single calendar day reached at least min_day events from that ASN.","Business names come from geo/ASN enrichment on observed IPs (best-effort).","why_likely / category are heuristics for operator triage \u2014 not accusations or legal conclusions.","Your prefix is private customer infrastructure; third-party commercial scanning is unsolicited."],"threshold_peak_day_events":12,"window_days":null}