← Back to feed
Subnet 66.132.172.0/24
SUBNET Active highWhy this campaign was detected
39 IPs from the same /24 subnet (66.132.172.0/24) were observed attacking our sensors within the same time window. All belong to Censys, Inc. (AS398324). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.
Primary ASN
AS398324 · Censys, Inc.
Subnet
66.132.172.0/24
Country
🇺🇸 US
Cloud Provider
—
Member Count
39 IPs
Below average
Total Events
880
Below average by volume
Started / Ended
2026-03-19 22:52 — ongoing
Attack Types
MITRE ATT&CK Techniques
Member Actors
| IP Address | Behavior | Confidence | Flags | Events | Agents | Attack Types | Hostname | Last Seen | |
|---|---|---|---|---|---|---|---|---|---|
| 66.132.172.186 | scanner | 10% | 54 | 4 | http:scanssh:connectiontelnet:connection | 186.172.132.66.censys-scanner.com | 2026-10-15 11:37 | evidence → | |
| 66.132.172.97 | scanner | 10% | 1x OSINT | 53 | 4 | http:scanssh:connectiontelnet:connection | 97.172.132.66.censys-scanner.com | 2026-10-17 19:26 | evidence → |
| 66.132.172.139 | scanner | 10% | 49 | 3 | http:scanssh:connectiontelnet:connection | 139.172.132.66.censys-scanner.com | 2026-10-10 02:34 | evidence → | |
| 66.132.172.199 | scanner | 10% | 47 | 4 | http:scanssh:connectiontelnet:connection | 199.172.132.66.censys-scanner.com | 2026-10-18 23:59 | evidence → | |
| 66.132.172.136 | scanner | 10% | 1x OSINT | 47 | 4 | http:scanssh:connectiontelnet:connection | 136.172.132.66.censys-scanner.com | 2026-10-11 23:40 | evidence → |
| 66.132.172.101 | scanner | 10% | 45 | 4 | http:scanssh:connectiontelnet:connection | 101.172.132.66.censys-scanner.com | 2026-10-16 08:46 | evidence → | |
| 66.132.172.187 | scanner | 10% | 44 | 4 | http:scanssh:connectiontelnet:connection | 187.172.132.66.censys-scanner.com | 2026-10-10 23:03 | evidence → | |
| 66.132.172.183 | scanner | 10% | 1x OSINT | 43 | 3 | http:scanssh:connectiontelnet:connection | 183.172.132.66.censys-scanner.com | 2026-10-17 19:42 | evidence → |
| 66.132.172.108 | scanner | 10% | 41 | 3 | http:scanssh:connectiontelnet:connection | 108.172.132.66.censys-scanner.com | 2026-10-18 16:40 | evidence → | |
| 66.132.172.195 | scanner | 10% | 38 | 4 | http:scanssh:connectiontelnet:connection | 195.172.132.66.censys-scanner.com | 2026-10-18 20:32 | evidence → | |
| 66.132.172.141 | scanner | 10% | 1x OSINT | 38 | 3 | http:scanssh:connectiontelnet:connection | 141.172.132.66.censys-scanner.com | 2026-10-07 00:39 | evidence → |
| 66.132.172.201 | scanner | 10% | 35 | 3 | http:scanssh:connectiontelnet:connection | 201.172.132.66.censys-scanner.com | 2026-10-18 19:34 | evidence → | |
| 66.132.172.131 | scanner | 10% | 35 | 3 | http:scanssh:connectiontelnet:connection | 131.172.132.66.censys-scanner.com | 2026-10-18 11:36 | evidence → | |
| 66.132.172.96 | scanner | 10% | 34 | 2 | ssh:connectiontelnet:connection | 96.172.132.66.censys-scanner.com | 2026-10-05 16:38 | evidence → | |
| 66.132.172.32 | scanner | 10% | 1x OSINT | 32 | 3 | http:scanssh:connectiontelnet:connection | 32.172.132.66.censys-scanner.com | 2026-10-12 23:33 | evidence → |
| 66.132.172.104 | scanner | 10% | 31 | 4 | http:scanssh:connectiontelnet:connection | 104.172.132.66.censys-scanner.com | 2026-10-18 19:34 | evidence → | |
| 66.132.172.134 | scanner | 10% | 30 | 3 | http:scanssh:connectiontelnet:connection | 134.172.132.66.censys-scanner.com | 2026-10-02 06:51 | evidence → | |
| 66.132.172.133 | scanner | 10% | 1x OSINT | 30 | 3 | http:scanssh:connectiontelnet:connection | 133.172.132.66.censys-scanner.com | 2026-10-07 07:01 | evidence → |
| 66.132.172.34 | scanner | 10% | 28 | 4 | http:scanssh:connectiontelnet:connection | 34.172.132.66.censys-scanner.com | 2026-10-14 15:37 | evidence → | |
| 66.132.172.100 | scanner | 10% | 28 | 3 | http:scanssh:connectiontelnet:connection | 100.172.132.66.censys-scanner.com | 2026-10-14 18:08 | evidence → | |
| 66.132.172.222 | scanner | 10% | 27 | 2 | http:scanssh:connectiontelnet:connection | 222.172.132.66.censys-scanner.com | 2026-10-14 10:36 | evidence → | |
| 66.132.172.137 | web_probe | 10% | 1x OSINT | 24 | 4 | http:scanssh:connectiontelnet:connection | 137.172.132.66.censys-scanner.com | 2026-10-18 20:42 | evidence → |
| 66.132.172.43 | scanner | 10% | 1x OSINT | 24 | 3 | ssh:connectiontelnet:connection | 43.172.132.66.censys-scanner.com | 2026-10-15 18:44 | evidence → |
| 66.132.172.210 | scanner | 10% | 21 | 3 | http:scanssh:connectiontelnet:connection | 210.172.132.66.censys-scanner.com | 2026-10-03 11:32 | evidence → | |
| 66.132.172.128 | web_probe | 10% | 21 | 3 | http:scanssh:connection | 128.172.132.66.censys-scanner.com | 2026-10-05 10:07 | evidence → | |
| 66.132.172.216 | scanner | 10% | 21 | 3 | http:scanssh:connectiontelnet:connection | 216.172.132.66.censys-scanner.com | 2026-10-07 00:40 | evidence → | |
| 66.132.172.220 | scanner | 10% | 21 | 3 | http:scanssh:connectiontelnet:connection | 220.172.132.66.censys-scanner.com | 2026-10-13 10:19 | evidence → | |
| 66.132.172.44 | scanner | 10% | 1x OSINT | 21 | 3 | http:scanssh:connectiontelnet:connection | 44.172.132.66.censys-scanner.com | 2026-10-07 07:41 | evidence → |
| 66.132.172.36 | scanner | 10% | 20 | 3 | http:scanssh:connectiontelnet:connection | 36.172.132.66.censys-scanner.com | 2026-10-13 19:31 | evidence → | |
| 66.132.172.109 | scanner | 10% | 20 | 3 | http:scanssh:connectiontelnet:connection | 109.172.132.66.censys-scanner.com | 2026-10-01 05:40 | evidence → | |
| 66.132.172.209 | scanner | 10% | 17 | 3 | http:scanssh:connectiontelnet:connection | 209.172.132.66.censys-scanner.com | 2026-10-16 17:26 | evidence → | |
| 66.132.172.188 | scanner | 10% | 1x OSINT | 16 | 3 | http:scantelnet:connection | 188.172.132.66.censys-scanner.com | 2026-10-04 08:38 | evidence → |
| 66.132.172.143 | web_probe | 10% | 14 | 4 | http:scanssh:connectiontelnet:connection | 143.172.132.66.censys-scanner.com | 2026-10-09 19:33 | evidence → | |
| 66.132.172.221 | web_probe | 10% | 1x OSINT | 14 | 4 | http:scanssh:connectiontelnet:connection | 221.172.132.66.censys-scanner.com | 2026-10-08 13:52 | evidence → |
| 66.132.172.180 | scanner | 10% | 12 | 3 | http:scanssh:connectiontelnet:connection | 180.172.132.66.censys-scanner.com | 2026-10-05 06:25 | evidence → | |
| 66.132.172.204 | scanner | 10% | 12 | 3 | http:scanssh:connectiontelnet:connection | 204.172.132.66.censys-scanner.com | 2026-10-01 05:40 | evidence → | |
| 66.132.172.219 | scanner | 10% | 11 | 3 | http:scanssh:connectiontelnet:connection | 219.172.132.66.censys-scanner.com | 2026-10-11 10:37 | evidence → | |
| 66.132.172.105 | web_probe | 10% | 10 | 3 | http:scanssh:connection | 105.172.132.66.censys-scanner.com | 2026-10-05 20:48 | evidence → | |
| 66.132.172.194 | web_probe | 10% | 1 | 1 | http:scan | 194.172.132.66.censys-scanner.com | 2026-10-04 11:49 | evidence → |
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds