← Back to feed

Subnet 89.37.172.0/24

SUBNET Ended high

Why this campaign was detected

3 IPs from the same /24 subnet (89.37.172.0/24) were observed attacking our sensors within the same time window. All belong to Hydra Communications Ltd (AS25369). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS25369 · Hydra Communications Ltd

Subnet

89.37.172.0/24

Country

🇬🇧 GB

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-06-06 16:48 — ongoing

Attack Types

http:scan ssh:connection telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Initial Access

T1190

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
89.37.172.141	web_probe	36%	1x OSINT	4	2	http:scanssh:connection	89-37-172-141.infrawat.ch	2026-10-02 12:55	evidence →
89.37.172.130	scanner	35%	1x OSINT	10	2	ssh:connectiontelnet:connection	89-37-172-130.infrawat.ch	2026-10-05 19:24	evidence →
89.37.172.133	scanner	26%	1x OSINT	4	2	ssh:connection	89-37-172-133.infrawat.ch	2026-10-05 21:08	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds