← Back to feed

Subnet 130.250.191.0/24

SUBNET Ended high

Why this campaign was detected

4 IPs from the same /24 subnet (130.250.191.0/24) were observed attacking our sensors within the same time window. All belong to HosterDaddy Private Limited (AS215117). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS215117 · HosterDaddy Private Limited

Subnet

130.250.191.0/24

Country

🇮🇳 IN

Cloud Provider

—

Member Count

4 IPs

Below average

Total Events

978

Below average by volume

Started / Ended

2026-02-16 18:49 — 2026-05-23 09:10

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Initial Access

T1078

Credential Access

T1110 T1110.001

Command and Control

T1105

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
130.250.191.201	credential_harvester	50%	DROP	494	2	ssh:bruteforce	ip-130-250-191-201.hosted-by-hosterdaddy.com	2026-04-04 04:57	evidence →
130.250.191.204	credential_harvester	50%	DROP	455	2	ssh:bruteforce	ip-130-250-191-204.hosted-by-hosterdaddy.com	2026-04-09 09:41	evidence →
130.250.191.200	credential_harvester	49%	DROP	292	2	ssh:bruteforce	ip-130-250-191-200.hosted-by-hosterdaddy.com	2026-03-30 08:33	evidence →
130.250.191.199	credential_harvester	48%	DROP	119	2	ssh:bruteforce	ip-130-250-191-199.hosted-by-hosterdaddy.com	2026-04-16 09:08	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds