← Back to feed

Subnet 86.54.31.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (86.54.31.0/24) were observed attacking our sensors within the same time window. All belong to Black HOST Ltd (AS12989). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS12989 · Black HOST Ltd

Subnet

86.54.31.0/24

Country

🇨🇦 CA

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-03-18 04:26 — ongoing

Attack Types

ftp:bruteforce http:scan ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1190

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
86.54.31.38	scanner	59%	3x OSINT	18	2	ftp:bruteforcehttp:scanssh:bruteforce	—	2026-05-18 04:22	evidence →
86.54.31.40	scanner	39%	1x OSINT	17	2	http:scanssh:bruteforce	—	2026-04-10 19:34	evidence →
86.54.31.32	ftp_probe	35%	2x OSINT	2	2	ftp:bruteforcehttp:scan	—	2026-05-05 21:40	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds