← Back to feed

Subnet 85.11.167.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (85.11.167.0/24) were observed attacking our sensors within the same time window. All belong to ColocaTel Inc. (AS213438). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS213438 · ColocaTel Inc.

Subnet

85.11.167.0/24

Country

🇧🇬 BG

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

229373

Above average by volume

Started / Ended

2026-03-30 04:32 — ongoing

Attack Types

http:scan mysql:bruteforce ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1190

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
85.11.167.2	mysql_bruter	60%	DROP	229368	3	mysql:bruteforce	—	2026-05-01 11:34	evidence →
85.11.167.8	scanner	39%	DROP1x OSINT	4	2	ssh:bruteforce	—	2026-05-01 10:08	evidence →
85.11.167.46	web_probe	17%	DROP	1	1	http:scan	—	2026-04-26 15:55	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds