IntrusionLabs IntrusionLabs
← Back to feed

AS16276 OVH SAS

ASN Active medium
Why this campaign was detected
33 IPs from the same network (OVH SAS, AS16276) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS16276 · OVH SAS
Subnet
—
Country
🇨🇦 CA
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
13762
Below average by volume
Started / Ended
2026-02-18 00:22 — ongoing
Attack Types
http:scan ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
176.31.21.38 credential_harvester 59% 1x OSINT 736 1 ssh:bruteforce — 2026-07-17 17:14 evidence →
51.89.164.5 credential_harvester 59% 1x OSINT 556 1 ssh:bruteforce — 2026-07-17 17:59 evidence →
51.89.166.227 opportunistic_bruter 53% 1x OSINT 23 1 ssh:bruteforce — 2026-07-16 11:34 evidence →
135.125.226.120 credential_harvester 53% 1x OSINT 556 1 ssh:bruteforce — 2026-07-14 08:47 evidence →
51.79.99.235 credential_harvester 53% 1x OSINT 1192 2 ssh:bruteforce — 2026-07-17 00:26 evidence →
51.81.33.138 opportunistic_bruter 50% 1x OSINT 23 1 ssh:bruteforce — 2026-07-15 23:22 evidence →
148.113.221.114 credential_harvester 49% 1x OSINT 848 2 ssh:bruteforce — 2026-07-15 11:37 evidence →
144.217.74.127 credential_harvester 48% 1x OSINT 1060 2 ssh:bruteforce — 2026-07-14 09:19 evidence →
193.70.122.120 credential_harvester 45% 742 2 ssh:bruteforce — 2026-07-15 13:11 evidence →
149.56.241.206 credential_harvester 44% 826 2 ssh:bruteforce — 2026-07-15 10:10 evidence →
149.202.42.118 credential_harvester 44% 1x OSINT 2203 1 ssh:bruteforce — 2026-07-14 08:04 evidence →
51.75.149.221 credential_harvester 44% 1038 2 ssh:bruteforce — 2026-07-14 18:25 evidence →
149.56.143.217 data_exfiltrator 43% 1x OSINT 6 1 ssh:bruteforce — 2026-07-14 18:31 evidence →
141.11.21.65 opportunistic_bruter 43% 60 2 ssh:bruteforce — 2026-07-15 13:56 evidence →
51.79.77.114 opportunistic_bruter 43% 65 2 ssh:bruteforce — 2026-07-15 11:40 evidence →
158.69.227.40 credential_harvester 43% 1036 2 ssh:bruteforce — 2026-07-14 04:49 evidence →
146.59.144.192 opportunistic_bruter 42% 50 2 ssh:bruteforce — 2026-07-15 13:29 evidence →
141.11.21.212 opportunistic_bruter 42% 54 2 ssh:bruteforce — 2026-07-15 09:58 evidence →
192.95.10.202 credential_harvester 41% 406 2 ssh:bruteforce — 2026-07-14 01:25 evidence →
57.128.195.102 opportunistic_bruter 41% 40 2 ssh:bruteforce — 2026-07-14 18:07 evidence →
51.68.126.146 credential_harvester 40% 340 2 ssh:bruteforce — 2026-07-13 19:43 evidence →
167.114.156.169 credential_harvester 40% 510 2 ssh:bruteforce — 2026-07-13 09:05 evidence →
192.99.55.156 opportunistic_bruter 39% 30 2 ssh:bruteforce — 2026-07-14 09:34 evidence →
51.79.67.63 credential_harvester 39% 432 2 ssh:bruteforce — 2026-07-13 01:15 evidence →
5.39.70.2 scanner 39% 1x OSINT 10 2 ssh:bruteforce — 2026-07-17 03:27 evidence →
148.113.221.241 credential_harvester 39% 840 2 ssh:bruteforce — 2026-07-12 05:07 evidence →
51.77.202.59 reconnaissance 35% 1x OSINT 8 1 ssh:bruteforce — 2026-07-14 00:49 evidence →
51.89.199.115 web_probe 33% 1x OSINT 2 2 http:scan — 2026-07-14 00:41 evidence →
135.125.97.69 reconnaissance 33% 11 1 ssh:bruteforce — 2026-07-15 02:10 evidence →
15.235.36.67 opportunistic_bruter 32% 20 1 ssh:bruteforce — 2026-07-15 10:24 evidence →
146.59.158.95 reconnaissance 27% 32 1 ssh:bruteforce — 2026-07-11 08:16 evidence →
51.195.255.48 credential_probe 20% 1x OSINT 5 1 ssh:bruteforce — 2026-07-13 07:17 evidence →
141.11.107.74 web_probe 14% 2 1 http:scan — 2026-07-11 03:32 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds