← Back to feed
Subnet 147.185.132.0/24
SUBNET Active highWhy this campaign was detected
50 IPs from the same /24 subnet (147.185.132.0/24) were observed attacking our sensors within the same time window. All belong to Google LLC (AS396982). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.
Primary ASN
AS396982 · Google LLC
Subnet
147.185.132.0/24
Country
🇺🇸 US
Cloud Provider
—
Member Count
50 IPs
Average
Total Events
1331
Below average by volume
Started / Ended
2026-02-16 19:56 — ongoing
Attack Types
MITRE ATT&CK Techniques
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 147.185.132.93 | scanner | 10% | 1x OSINT | 46 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-13 16:09 | evidence → |
| 147.185.132.33 | scanner | 10% | 46 | 3 | http:scanssh:connection | — | 2026-10-10 22:43 | evidence → | |
| 147.185.132.40 | scanner | 10% | 1x OSINT | 43 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-07 04:34 | evidence → |
| 147.185.132.0 | web_probe | 10% | 41 | 1 | http:scan | — | 2026-10-07 16:33 | evidence → | |
| 147.185.132.141 | scanner | 10% | 1x OSINT | 40 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-08 03:44 | evidence → |
| 147.185.132.21 | scanner | 10% | 1x OSINT | 40 | 3 | http:scanssh:connection | — | 2026-10-07 17:59 | evidence → |
| 147.185.132.105 | scanner | 10% | 1x OSINT | 40 | 3 | ssh:connectiontelnet:connection | — | 2026-10-07 04:09 | evidence → |
| 147.185.132.61 | scanner | 10% | 1x OSINT | 39 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-17 22:20 | evidence → |
| 147.185.132.79 | scanner | 10% | 1x OSINT | 38 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-15 10:30 | evidence → |
| 147.185.132.213 | scanner | 10% | 1x OSINT | 38 | 3 | ssh:connection | — | 2026-10-05 22:30 | evidence → |
| 147.185.132.3 | web_probe | 10% | 36 | 1 | http:scan | — | 2026-10-14 00:37 | evidence → | |
| 147.185.132.237 | scanner | 10% | 1x OSINT | 36 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-18 01:53 | evidence → |
| 147.185.132.18 | scanner | 10% | 1x OSINT | 35 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-14 10:26 | evidence → |
| 147.185.132.90 | scanner | 10% | 1x OSINT | 35 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-05 10:32 | evidence → |
| 147.185.132.100 | scanner | 10% | 1x OSINT | 34 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-05 01:38 | evidence → |
| 147.185.132.37 | scanner | 10% | 1x OSINT | 33 | 4 | http:scanssh:connection | — | 2026-10-18 04:24 | evidence → |
| 147.185.132.19 | scanner | 10% | 1x OSINT | 32 | 4 | http:scanssh:connection | — | 2026-10-03 10:42 | evidence → |
| 147.185.132.2 | web_probe | 10% | 31 | 1 | http:scan | — | 2026-10-16 01:53 | evidence → | |
| 147.185.132.243 | scanner | 10% | 30 | 4 | http:scanssh:connection | — | 2026-10-04 16:40 | evidence → | |
| 147.185.132.31 | scanner | 10% | 1x OSINT | 30 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-09 09:13 | evidence → |
| 147.185.132.28 | scanner | 10% | 1x OSINT | 30 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-05 18:54 | evidence → |
| 147.185.132.78 | scanner | 10% | 1x OSINT | 30 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-16 15:43 | evidence → |
| 147.185.132.49 | scanner | 10% | 1x OSINT | 29 | 3 | http:scanssh:connection | — | 2026-10-03 04:10 | evidence → |
| 147.185.132.4 | web_probe | 10% | 28 | 1 | http:scan | — | 2026-10-03 18:13 | evidence → | |
| 147.185.132.67 | scanner | 10% | 1x OSINT | 28 | 3 | http:scanssh:connection | — | 2026-10-05 10:52 | evidence → |
| 147.185.132.195 | scanner | 10% | 1x OSINT | 28 | 3 | ssh:connectiontelnet:connection | — | 2026-10-03 10:17 | evidence → |
| 147.185.132.210 | scanner | 10% | 1x OSINT | 28 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-08 15:52 | evidence → |
| 147.185.132.183 | scanner | 10% | 1x OSINT | 27 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-17 04:41 | evidence → |
| 147.185.132.6 | web_probe | 10% | 27 | 1 | http:scan | — | 2026-10-08 02:17 | evidence → | |
| 147.185.132.88 | scanner | 10% | 1x OSINT | 26 | 3 | ssh:connectiontelnet:connection | — | 2026-10-12 19:05 | evidence → |
| 147.185.132.222 | scanner | 10% | 1x OSINT | 26 | 3 | ssh:connection | — | 2026-10-01 10:35 | evidence → |
| 147.185.132.82 | web_probe | 10% | 24 | 3 | http:scanssh:connection | — | 2026-10-10 17:41 | evidence → | |
| 147.185.132.22 | scanner | 10% | 1x OSINT | 23 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-04 04:19 | evidence → |
| 147.185.132.132 | scanner | 10% | 23 | 4 | http:scanssh:connection | — | 2026-10-07 18:56 | evidence → | |
| 147.185.132.54 | scanner | 10% | 1x OSINT | 23 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-04 19:41 | evidence → |
| 147.185.132.10 | scanner | 10% | 1x OSINT | 23 | 4 | http:scanssh:connection | xq91aeltlck | 2026-10-07 02:45 | evidence → |
| 147.185.132.103 | scanner | 10% | 1x OSINT | 21 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-13 16:49 | evidence → |
| 147.185.132.1 | web_probe | 10% | 21 | 1 | http:scan | — | 2026-10-08 19:02 | evidence → | |
| 147.185.132.138 | scanner | 10% | 21 | 4 | http:scanssh:connection | — | 2026-10-08 21:12 | evidence → | |
| 147.185.132.192 | scanner | 10% | 1x OSINT | 21 | 3 | http:scanssh:connection | — | 2026-10-09 16:47 | evidence → |
| 147.185.132.69 | scanner | 10% | 1x OSINT | 21 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-16 16:40 | evidence → |
| 147.185.132.66 | scanner | 10% | 1x OSINT | 20 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-16 16:05 | evidence → |
| 147.185.132.198 | scanner | 10% | 1x OSINT | 20 | 3 | http:scanssh:connection | — | 2026-10-02 06:17 | evidence → |
| 147.185.132.76 | scanner | 10% | 1x OSINT | 20 | 4 | http:scanssh:connectiontelnet:connection | — | 2026-10-18 15:56 | evidence → |
| 147.185.132.42 | scanner | 10% | 1x OSINT | 18 | 3 | http:scanssh:connectiontelnet:connection | — | 2026-10-01 16:33 | evidence → |
| 147.185.132.171 | scanner | 10% | 1x OSINT | 18 | 3 | http:scanssh:connection | — | 2026-10-01 04:56 | evidence → |
| 147.185.132.162 | scanner | 10% | 14 | 3 | ssh:connectiontelnet:connection | — | 2026-10-03 15:39 | evidence → | |
| 147.185.132.168 | web_probe | 10% | 1x OSINT | 12 | 3 | http:scanssh:connection | — | 2026-10-04 18:27 | evidence → |
| 147.185.132.111 | web_probe | 10% | 1x OSINT | 12 | 3 | http:scanssh:connection | — | 2026-10-14 17:10 | evidence → |
| 147.185.132.96 | web_probe | 10% | 1x OSINT | 8 | 2 | http:scanssh:connection | — | 2026-10-03 06:18 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds