← Back to feed

Subnet 104.152.52.0/24

SUBNET Active high

Why this campaign was detected

19 IPs from the same /24 subnet (104.152.52.0/24) were observed attacking our sensors within the same time window. All belong to Rethem Hosting LLC (AS14987). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS14987 · Rethem Hosting LLC

Subnet

104.152.52.0/24

Country

🇺🇸 US

Cloud Provider

—

Member Count

19 IPs

Below average

Total Events

289

Below average by volume

Started / Ended

2026-02-19 01:57 — ongoing

Attack Types

ssh:connection ssh:intrusion telnet:connection telnet:intrusion

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001

Initial Access

T1078

Execution

T1059.004

Discovery

T1016 T1046 T1082

Member Actors

IP Address	Behavior	Confidence	Events	Agents	Attack Types	Hostname	Last Seen
104.152.52.212	scanner	70%	28	3	ssh:connectionssh:intrusiontelnet:connectiontelnet:intrusion	internettl.org	2026-10-14 07:43	evidence →
104.152.52.211	scanner	62%	22	3	ssh:connectionssh:intrusiontelnet:connectiontelnet:intrusion	internettl.org	2026-10-14 07:43	evidence →
104.152.52.214	scanner	52%	13	3	ssh:connectiontelnet:connection	internettl.org	2026-10-15 22:17	evidence →
104.152.52.207	scanner	51%	40	3	ssh:connectiontelnet:connection	internettl.org	2026-10-14 07:43	evidence →
104.152.52.200	scanner	50%	20	3	ssh:connectiontelnet:connection	internettl.org	2026-10-14 07:43	evidence →
104.152.52.213	scanner	50%	14	3	ssh:connectiontelnet:connection	internettl.org	2026-10-14 07:43	evidence →
104.152.52.203	scanner	42%	18	3	ssh:connection	internettl.org	2026-10-14 07:43	evidence →
104.152.52.131	scanner	39%	13	2	ssh:connectiontelnet:connection	internettl.org	2026-10-16 21:59	evidence →
104.152.52.143	scanner	39%	11	2	ssh:connectiontelnet:connection	internettl.org	2026-10-16 21:59	evidence →
104.152.52.210	scanner	38%	20	2	ssh:connectiontelnet:connection	internettl.org	2026-10-15 22:17	evidence →
104.152.52.105	scanner	33%	10	2	ssh:connection	internettl.org	2026-10-17 21:54	evidence →
104.152.52.109	scanner	32%	8	2	ssh:connection	internettl.org	2026-10-17 21:54	evidence →
104.152.52.149	scanner	31%	22	2	ssh:connection	internettl.org	2026-10-16 04:16	evidence →
104.152.52.147	scanner	29%	8	2	ssh:connection	internettl.org	2026-10-16 04:16	evidence →
104.152.52.148	scanner	27%	16	2	ssh:connection	internettl.org	2026-10-14 07:38	evidence →
104.152.52.115	scanner	26%	9	1	ssh:connection	internettl.org	2026-10-19 05:24	evidence →
104.152.52.100	scanner	25%	4	1	ssh:connection	internettl.org	2026-10-19 05:24	evidence →
104.152.52.119	scanner	22%	5	2	ssh:connection	internettl.org	2026-10-12 21:48	evidence →
104.152.52.114	scanner	14%	8	1	ssh:connection	internettl.org	2026-10-12 21:48	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds