← Back to feed

Subnet 45.227.254.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (45.227.254.0/24) were observed attacking our sensors within the same time window. All belong to Flyservers S.A. (AS267784). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS267784 · Flyservers S.A.

Subnet

45.227.254.0/24

Country

🇵🇦 PA

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

245

Below average by volume

Started / Ended

2026-03-13 10:22 — ongoing

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595

Initial Access

T1078

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
45.227.254.170	opportunistic_bruter	73%	2x OSINT	215	3	ssh:bruteforce	—	2026-06-05 07:08	evidence →
45.227.254.152	scanner	41%	1x OSINT	15	2	ssh:bruteforce	—	2026-06-05 04:23	evidence →
45.227.254.156	scanner	28%	1x OSINT	15	2	ssh:bruteforce	—	2026-05-29 08:03	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds