← Back to feed
AS396982 Google LLC
ASN Active mediumWhy this campaign was detected
71 IPs from the same network (Google LLC, AS396982) were active during overlapping time periods. Temporal correlation across a shared autonomous system suggests infrastructure controlled by the same entity.
Primary ASN
AS396982 · Google LLC
Subnet
—
Country
🇧🇪 BE
Cloud Provider
—
Member Count
71 IPs
Average
Total Events
7260
Below average by volume
Started / Ended
2026-02-18 00:32 — ongoing
Attack Types
MITRE ATT&CK Techniques
Command and Control
Exfiltration
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 34.78.29.97 | credential_harvester | 77% | 1x OSINT | 2910 | 3 | ssh:bruteforce | 97.29.78.34.bc.googleusercontent.com | 2026-08-28 18:35 | evidence → |
| 34.58.124.191 | credential_harvester | 75% | 1x OSINT | 2293 | 3 | ssh:bruteforce | — | 2026-08-27 18:40 | evidence → |
| 35.187.231.181 | credential_harvester | 59% | 1x OSINT | 1475 | 2 | ssh:bruteforce | — | 2026-09-01 03:22 | evidence → |
| 34.38.245.25 | mysql_bruter | 54% | 1x OSINT | 9 | 3 | ftp:bruteforcemysql:bruteforce | — | 2026-08-27 03:14 | evidence → |
| 34.78.114.97 | mysql_bruter | 54% | 6 | 3 | ftp:bruteforcemysql:bruteforce | — | 2026-08-29 20:47 | evidence → | |
| 35.200.201.144 | opportunistic_bruter | 53% | 70 | 3 | ssh:bruteforce | 144.201.200.35.bc.googleusercontent.com | 2026-08-27 15:01 | evidence → | |
| 34.62.168.168 | ftp_bruter | 53% | 10 | 3 | ftp:bruteforcemysql:bruteforce | — | 2026-08-28 19:42 | evidence → | |
| 34.62.175.133 | ftp_probe | 51% | 4 | 3 | ftp:bruteforcemysql:bruteforce | — | 2026-08-29 19:55 | evidence → | |
| 104.155.5.16 | mysql_probe | 47% | 4 | 3 | ftp:bruteforcemysql:bruteforce | — | 2026-08-27 23:59 | evidence → | |
| 34.53.216.85 | mysql_probe | 47% | 3 | 3 | mysql:bruteforce | — | 2026-08-31 15:33 | evidence → | |
| 34.156.144.87 | mysql_probe | 45% | 5 | 3 | ftp:bruteforcemysql:bruteforce | — | 2026-08-26 16:49 | evidence → | |
| 34.78.169.100 | scanner | 45% | 1x OSINT | 17 | 2 | ssh:bruteforce | — | 2026-08-31 06:22 | evidence → |
| 34.52.235.172 | scanner | 38% | 3x OSINT | 9 | 1 | ssh:bruteforce | — | 2026-08-31 03:23 | evidence → |
| 34.155.85.143 | scanner | 36% | 1x OSINT | 14 | 1 | ssh:bruteforce | — | 2026-08-29 00:05 | evidence → |
| 34.125.81.104 | web_probe | 36% | 8 | 2 | http:scan | — | 2026-08-30 09:16 | evidence → | |
| 34.77.52.156 | ftp_probe | 36% | 1x OSINT | 2 | 2 | ftp:bruteforcemysql:bruteforce | — | 2026-08-28 00:13 | evidence → |
| 34.62.243.210 | scanner | 36% | 1x OSINT | 35 | 1 | ssh:bruteforce | — | 2026-08-31 14:55 | evidence → |
| 104.155.37.1 | scanner | 34% | 1x OSINT | 9 | 1 | ssh:bruteforce | — | 2026-08-31 03:20 | evidence → |
| 34.78.76.20 | ftp_probe | 34% | 3 | 2 | ftp:bruteforcemysql:bruteforce | — | 2026-08-29 00:13 | evidence → | |
| 35.239.2.38 | reconnaissance | 33% | 1x OSINT | 8 | 1 | ssh:bruteforce | — | 2026-08-27 09:57 | evidence → |
| 34.76.168.189 | ftp_probe | 32% | 4 | 2 | ftp:bruteforce | — | 2026-08-31 19:11 | evidence → | |
| 136.113.90.212 | data_exfiltrator | 32% | 6 | 1 | ssh:bruteforce | — | 2026-08-25 23:44 | evidence → | |
| 104.199.72.69 | ftp_probe | 32% | 2 | 2 | ftp:bruteforcemysql:bruteforce | — | 2026-08-28 07:07 | evidence → | |
| 34.156.47.23 | ftp_probe | 32% | 2 | 2 | ftp:bruteforce | — | 2026-09-01 09:59 | evidence → | |
| 104.199.102.70 | scanner | 32% | 1x OSINT | 9 | 1 | ssh:bruteforce | — | 2026-08-31 15:11 | evidence → |
| 34.52.198.38 | scanner | 32% | 1x OSINT | 9 | 1 | ssh:bruteforce | — | 2026-08-31 14:53 | evidence → |
| 34.52.143.163 | scanner | 31% | 9 | 1 | ssh:bruteforce | — | 2026-08-30 04:27 | evidence → | |
| 104.199.76.244 | scanner | 31% | 9 | 1 | ssh:bruteforce | — | 2026-08-30 02:46 | evidence → | |
| 35.195.86.215 | scanner | 31% | 9 | 1 | ssh:bruteforce | — | 2026-08-30 02:31 | evidence → | |
| 34.62.151.255 | scanner | 29% | 6 | 1 | ssh:bruteforce | — | 2026-08-30 04:27 | evidence → | |
| 34.140.86.76 | scanner | 29% | 6 | 1 | ssh:bruteforce | — | 2026-08-30 02:37 | evidence → | |
| 34.22.246.240 | mysql_bruter | 27% | 10 | 1 | mysql:bruteforce | — | 2026-08-31 20:25 | evidence → | |
| 34.21.89.109 | web_probe | 27% | 4 | 1 | http:scan | — | 2026-09-01 06:49 | evidence → | |
| 34.96.44.3 | web_probe | 27% | 3 | 1 | http:scan | — | 2026-08-30 20:39 | evidence → | |
| 34.78.43.48 | mysql_bruter | 26% | 7 | 1 | mysql:bruteforce | — | 2026-08-31 14:28 | evidence → | |
| 34.96.48.130 | web_probe | 26% | 3 | 1 | http:scan | — | 2026-08-30 13:47 | evidence → | |
| 35.195.44.217 | mysql_bruter | 26% | 10 | 1 | mysql:bruteforce | — | 2026-08-31 05:41 | evidence → | |
| 34.96.62.114 | web_probe | 26% | 2 | 1 | http:scan | — | 2026-08-31 17:09 | evidence → | |
| 34.96.41.174 | web_probe | 26% | 2 | 1 | http:scan | — | 2026-08-31 17:02 | evidence → | |
| 34.96.46.127 | web_probe | 26% | 3 | 1 | http:scan | — | 2026-08-31 08:16 | evidence → | |
| 207.175.215.6 | web_probe | 26% | 3 | 1 | http:scan | — | 2026-08-30 04:21 | evidence → | |
| 34.96.49.184 | web_probe | 26% | 3 | 1 | http:scan | — | 2026-08-31 02:32 | evidence → | |
| 34.34.233.182 | web_probe | 25% | 3 | 1 | http:scan | — | 2026-08-31 01:47 | evidence → | |
| 34.74.242.206 | web_probe | 25% | 30 | 1 | http:scan | — | 2026-08-29 15:43 | evidence → | |
| 34.156.141.174 | ftp_probe | 25% | 2 | 2 | ftp:bruteforce | — | 2026-08-28 14:21 | evidence → | |
| 207.175.143.70 | ftp_probe | 23% | 2 | 2 | ftp:bruteforce | — | 2026-08-27 20:52 | evidence → | |
| 104.196.53.55 | web_probe | 23% | 8 | 1 | http:scan | — | 2026-08-29 10:54 | evidence → | |
| 130.211.65.217 | ftp_probe | 22% | 2 | 1 | ftp:bruteforce | — | 2026-08-31 13:59 | evidence → | |
| 34.138.191.208 | web_probe | 22% | 6 | 1 | http:scan | — | 2026-08-29 04:52 | evidence → | |
| 35.205.254.221 | ftp_probe | 22% | 2 | 1 | ftp:bruteforce | — | 2026-08-30 06:27 | evidence → | |
| 146.148.12.228 | web_probe | 22% | 2 | 1 | http:scan | — | 2026-08-29 17:58 | evidence → | |
| 35.205.64.140 | ftp_probe | 21% | 2 | 1 | ftp:bruteforce | — | 2026-08-30 05:34 | evidence → | |
| 216.25.89.159 | web_probe | 21% | 30 | 1 | http:scan | — | 2026-08-27 08:37 | evidence → | |
| 35.187.95.46 | ftp_probe | 21% | 4 | 2 | ftp:bruteforce | — | 2026-08-26 02:24 | evidence → | |
| 35.205.163.228 | web_probe | 19% | 2 | 1 | http:scan | — | 2026-08-28 14:30 | evidence → | |
| 216.25.89.158 | web_probe | 19% | 18 | 1 | http:scan | — | 2026-08-26 18:10 | evidence → | |
| 35.241.206.51 | ftp_probe | 19% | 2 | 2 | ftp:bruteforce | — | 2026-08-25 13:23 | evidence → | |
| 34.140.172.205 | scanner | 18% | 42 | 1 | ssh:bruteforce | — | 2026-08-26 03:13 | evidence → | |
| 136.124.33.247 | web_probe | 18% | 3 | 1 | http:scan | — | 2026-08-27 15:47 | evidence → | |
| 34.62.171.242 | scanner | 17% | 37 | 1 | ssh:bruteforce | — | 2026-08-26 04:07 | evidence → | |
| 34.96.60.153 | web_probe | 17% | 3 | 1 | http:scan | — | 2026-08-26 21:26 | evidence → | |
| 136.124.34.161 | web_probe | 17% | 3 | 1 | http:scan | — | 2026-08-26 20:13 | evidence → | |
| 34.96.49.140 | web_probe | 17% | 3 | 1 | http:scan | — | 2026-08-26 19:14 | evidence → | |
| 35.233.65.123 | mysql_bruter | 16% | 10 | 1 | mysql:bruteforce | — | 2026-08-26 03:32 | evidence → | |
| 34.140.236.57 | scanner | 16% | 9 | 1 | ssh:bruteforce | — | 2026-08-26 04:07 | evidence → | |
| 34.76.225.223 | scanner | 16% | 9 | 1 | ssh:bruteforce | — | 2026-08-26 02:59 | evidence → | |
| 35.205.236.220 | web_probe | 15% | 2 | 1 | http:scan | — | 2026-08-26 09:36 | evidence → | |
| 34.125.171.226 | web_probe | 15% | 3 | 1 | http:scan | — | 2026-08-25 22:37 | evidence → | |
| 34.62.178.249 | ftp_probe | 11% | 2 | 1 | ftp:bruteforce | — | 2026-08-26 06:35 | evidence → | |
| 34.53.128.60 | ftp_probe | 11% | 2 | 1 | ftp:bruteforce | — | 2026-08-26 06:26 | evidence → | |
| 34.22.119.218 | ftp_probe | 11% | 2 | 1 | ftp:bruteforce | — | 2026-08-26 06:33 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds