← Back to feed

Subnet 213.166.84.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (213.166.84.0/24) were observed attacking our sensors within the same time window. All belong to Hydra Communications Ltd (AS25369). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS25369 · Hydra Communications Ltd

Subnet

213.166.84.0/24

Country

🇬🇧 GB

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-05-14 11:40 — ongoing

Attack Types

http:scan ssh:connection telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Initial Access

T1190

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
213.166.84.35	scanner	48%	1x OSINT	12	3	ssh:connection	213-166-84-35.infrawat.ch	2026-10-15 02:44	evidence →
213.166.84.53	scanner	34%	1x OSINT	4	2	ssh:connectiontelnet:connection	213-166-84-53.infrawat.ch	2026-10-11 23:45	evidence →
213.166.84.56	web_probe	29%	1x OSINT	2	2	http:scan	213-166-84-56.infrawat.ch	2026-10-13 02:37	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds