← Back to feed

Subnet 94.102.49.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (94.102.49.0/24) were observed attacking our sensors within the same time window. All belong to IP Volume inc (AS202425). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS202425 · IP Volume inc

Subnet

94.102.49.0/24

Country

🇳🇱 NL

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

218

Below average by volume

Started / Ended

2026-02-23 04:15 — ongoing

Attack Types

ftp:bruteforce http:scan mysql:bruteforce ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1190

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
94.102.49.155	mysql_bruter	69%	DROP2x OSINT	187	3	ftp:bruteforcemysql:bruteforcessh:bruteforce	no-reverse-dns-configured.com	2026-05-11 18:12	evidence →
94.102.49.193	scanner	41%	DROP2x OSINT	10	2	http:scanssh:bruteforce	—	2026-04-26 10:14	evidence →
94.102.49.125	scanner	28%	DROP1x OSINT	2	1	ssh:bruteforce	—	2026-05-13 01:23	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds