← Back to feed
Subnet 195.184.76.0/24
SUBNET Active highWhy this campaign was detected
6 IPs from the same /24 subnet (195.184.76.0/24) were observed attacking our sensors within the same time window. All belong to ONYPHE SAS (AS213412). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.
Primary ASN
AS213412 · ONYPHE SAS
Subnet
195.184.76.0/24
Country
🇺🇸 US
Cloud Provider
—
Member Count
6 IPs
Below average
Total Events
35
Below average by volume
Started / Ended
2026-02-18 18:26 — ongoing
Attack Types
MITRE ATT&CK Techniques
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 195.184.76.188 | scanner | 10% | 1x OSINT | 14 | 2 | ssh:connection | jed.probe.onyphe.net | 2026-10-19 04:22 | evidence → |
| 195.184.76.151 | scanner | 10% | 8 | 2 | ssh:connection | richard.probe.onyphe.net | 2026-10-03 18:30 | evidence → | |
| 195.184.76.214 | scanner | 10% | 4 | 1 | ssh:connection | aron.probe.onyphe.net | 2026-10-03 18:30 | evidence → | |
| 195.184.76.25 | scanner | 10% | 1x OSINT | 4 | 1 | ssh:connection | villegas.probe.onyphe.net | 2026-10-05 04:20 | evidence → |
| 195.184.76.27 | scanner | 10% | 1x OSINT | 4 | 1 | ssh:connection | owen.probe.onyphe.net | 2026-10-06 11:13 | evidence → |
| 195.184.76.70 | scanner | 10% | 1x OSINT | 4 | 1 | ssh:connection | burton.probe.onyphe.net | 2026-10-06 11:10 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds