← Back to feed

Subnet 195.96.139.0/24

SUBNET Active high

Why this campaign was detected

8 IPs from the same /24 subnet (195.96.139.0/24) were observed attacking our sensors within the same time window. All belong to Driftnet Ltd (AS211298). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS211298 · Driftnet Ltd

Subnet

195.96.139.0/24

Country

🇬🇧 GB

Cloud Provider

—

Member Count

8 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-05-15 07:34 — ongoing

Attack Types

http:scan ssh:connection telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Initial Access

T1190

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
195.96.139.215	scanner	10%		9	2	http:scanssh:connectiontelnet:connection	r5-215-d7.monitoring.internet-measurement.com	2026-10-03 13:07	evidence →
195.96.139.37	scanner	10%		8	1	ssh:connectiontelnet:connection	r5-37-25.monitoring.internet-measurement.com	2026-10-01 14:24	evidence →
195.96.139.109	scanner	10%	1x OSINT	6	1	ssh:connection	r5-109-6d.monitoring.internet-measurement.com	2026-10-07 02:26	evidence →
195.96.139.175	scanner	10%		3	2	http:scantelnet:connection	r5-175-af.monitoring.internet-measurement.com	2026-10-04 16:23	evidence →
195.96.139.176	scanner	10%		2	1	telnet:connection	r5-176-b0.monitoring.internet-measurement.com	2026-10-04 16:35	evidence →
195.96.139.49	web_probe	10%		2	1	http:scan	r5-49-31.monitoring.internet-measurement.com	2026-10-17 00:58	evidence →
195.96.139.145	web_probe	10%	1x OSINT	1	1	http:scan	r5-145-91.monitoring.internet-measurement.com	2026-10-03 05:27	evidence →
195.96.139.151	web_probe	10%		1	1	http:scan	r5-151-97.monitoring.internet-measurement.com	2026-10-06 03:23	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds