IntrusionLabs IntrusionLabs
← Back to feed

AS16276 OVH SAS

ASN Active medium
Why this campaign was detected
53 IPs from the same network (OVH SAS, AS16276) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS16276 · OVH SAS
Subnet
—
Country
🇫🇷 FR
Cloud Provider
—
Member Count
53 IPs
Below average
Total Events
4006
Below average by volume
Started / Ended
2026-02-18 00:22 — ongoing
Attack Types
http:scan ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
51.75.194.10 credential_harvester 79% 1277 3 ssh:bruteforce — 2026-05-12 06:24 evidence →
51.75.247.232 credential_harvester 67% 1x OSINT 254 2 ssh:bruteforce — 2026-05-12 12:40 evidence →
51.75.64.35 credential_harvester 57% 1x OSINT 222 1 ssh:bruteforce — 2026-05-10 15:11 evidence →
54.37.230.54 opportunistic_bruter 52% 23 1 ssh:bruteforce — 2026-05-10 03:29 evidence →
135.148.27.89 credential_harvester 50% 1x OSINT 110 2 ssh:bruteforce — 2026-05-12 13:22 evidence →
51.91.111.247 credential_harvester 50% 1x OSINT 100 2 ssh:bruteforce — 2026-05-12 13:25 evidence →
57.128.255.67 credential_harvester 50% 1x OSINT 204 1 ssh:bruteforce — 2026-05-08 15:07 evidence →
141.95.34.214 credential_harvester 50% 1x OSINT 76 2 ssh:bruteforce — 2026-05-12 15:00 evidence →
167.114.156.169 credential_harvester 50% 1x OSINT 76 2 ssh:bruteforce — 2026-05-12 13:01 evidence →
51.75.149.221 credential_harvester 50% 1x OSINT 82 2 ssh:bruteforce — 2026-05-12 10:28 evidence →
144.217.74.127 credential_harvester 50% 1x OSINT 68 2 ssh:bruteforce — 2026-05-12 14:09 evidence →
148.113.221.241 credential_harvester 49% 1x OSINT 66 2 ssh:bruteforce — 2026-05-12 08:48 evidence →
149.56.241.206 credential_harvester 49% 1x OSINT 52 2 ssh:bruteforce — 2026-05-12 10:14 evidence →
148.113.190.153 credential_harvester 49% 1x OSINT 48 2 ssh:bruteforce — 2026-05-12 11:51 evidence →
37.59.115.172 credential_harvester 49% 1x OSINT 46 2 ssh:bruteforce — 2026-05-12 12:42 evidence →
148.113.222.4 opportunistic_bruter 49% 23 1 ssh:bruteforce — 2026-05-12 11:25 evidence →
51.81.34.254 credential_harvester 48% 1x OSINT 48 2 ssh:bruteforce — 2026-05-12 06:45 evidence →
51.79.99.235 credential_harvester 48% 1x OSINT 30 2 ssh:bruteforce — 2026-05-12 15:00 evidence →
51.79.177.223 credential_harvester 48% 1x OSINT 48 2 ssh:bruteforce — 2026-05-12 01:50 evidence →
142.44.247.134 credential_harvester 48% 1x OSINT 38 2 ssh:bruteforce — 2026-05-12 06:49 evidence →
51.77.222.142 credential_harvester 48% 1x OSINT 40 2 ssh:bruteforce — 2026-05-12 05:31 evidence →
193.70.122.120 credential_harvester 48% 1x OSINT 38 2 ssh:bruteforce — 2026-05-12 04:02 evidence →
141.11.21.145 scanner 48% 1x OSINT 320 1 ssh:bruteforce — 2026-05-12 07:20 evidence →
192.95.10.204 credential_harvester 47% 1x OSINT 20 2 ssh:bruteforce — 2026-05-12 06:06 evidence →
51.161.192.220 credential_harvester 44% 1x OSINT 42 2 ssh:bruteforce — 2026-05-09 23:30 evidence →
51.68.103.106 credential_harvester 43% 34 2 ssh:bruteforce — 2026-05-11 10:03 evidence →
148.113.221.114 credential_harvester 42% 1x OSINT 44 2 ssh:bruteforce — 2026-05-08 21:50 evidence →
148.113.160.5 credential_probe 41% 1x OSINT 32 2 ssh:bruteforce — 2026-05-12 11:32 evidence →
51.254.17.136 credential_probe 40% 1x OSINT 18 2 ssh:bruteforce — 2026-05-12 14:49 evidence →
147.135.97.163 credential_harvester 39% 48 2 ssh:bruteforce — 2026-05-09 19:35 evidence →
158.69.226.80 credential_probe 39% 1x OSINT 20 2 ssh:bruteforce — 2026-05-11 09:54 evidence →
51.255.204.163 credential_harvester 38% 28 2 ssh:bruteforce — 2026-05-09 22:05 evidence →
135.125.236.201 credential_harvester 37% 42 2 ssh:bruteforce — 2026-05-08 23:39 evidence →
51.77.85.238 credential_harvester 37% 68 2 ssh:bruteforce — 2026-05-08 09:11 evidence →
51.77.222.246 credential_harvester 37% 40 2 ssh:bruteforce — 2026-05-08 20:17 evidence →
51.210.15.158 credential_harvester 36% 1x OSINT 14 1 ssh:bruteforce — 2026-05-10 02:13 evidence →
57.131.46.57 credential_harvester 36% 1x OSINT 14 1 ssh:bruteforce — 2026-05-11 00:42 evidence →
146.59.229.155 credential_harvester 36% 1x OSINT 6 1 ssh:bruteforce — 2026-05-12 00:43 evidence →
54.39.133.9 credential_harvester 35% 1x OSINT 64 1 ssh:bruteforce — 2026-05-09 21:15 evidence →
141.94.94.32 credential_harvester 33% 1x OSINT 14 1 ssh:bruteforce — 2026-05-09 22:37 evidence →
15.204.226.23 credential_harvester 33% 1x OSINT 14 1 ssh:bruteforce — 2026-05-09 21:20 evidence →
148.113.201.25 credential_probe 31% 1x OSINT 26 1 ssh:bruteforce — 2026-05-12 05:22 evidence →
51.79.67.63 credential_probe 30% 1x OSINT 12 1 ssh:bruteforce — 2026-05-12 10:14 evidence →
15.204.229.113 credential_probe 30% 40 2 ssh:bruteforce — 2026-05-08 21:34 evidence →
51.68.126.146 credential_probe 29% 1x OSINT 12 1 ssh:bruteforce — 2026-05-12 02:06 evidence →
178.32.156.208 credential_harvester 28% 14 1 ssh:bruteforce — 2026-05-09 22:22 evidence →
194.59.183.226 credential_probe 28% 1x OSINT 6 1 ssh:bruteforce — 2026-05-12 00:44 evidence →
139.99.216.24 credential_probe 28% 1x OSINT 6 1 ssh:bruteforce — 2026-05-11 09:01 evidence →
51.81.85.130 credential_probe 25% 1x OSINT 20 1 ssh:bruteforce — 2026-05-09 09:25 evidence →
51.68.236.68 web_probe 23% 1x OSINT 2 1 http:scan — 2026-05-08 05:10 evidence →
51.222.96.124 credential_probe 21% 1x OSINT 6 1 ssh:bruteforce — 2026-05-08 03:35 evidence →
147.135.3.156 credential_probe 17% 1x OSINT 5 1 ssh:bruteforce — 2026-05-06 06:25 evidence →
146.59.47.168 credential_probe 16% 6 1 ssh:bruteforce — 2026-05-08 08:06 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds