← Back to feed

Subnet 103.83.87.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (103.83.87.0/24) were observed attacking our sensors within the same time window. All belong to Fiba Cloud Operation Company, LLC (AS44382). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS44382 · Fiba Cloud Operation Company, LLC

Subnet

103.83.87.0/24

Country

🇹🇷 TR

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-10-09 04:05 — ongoing

Attack Types

ssh:bruteforce ssh:connection telnet:bruteforce telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
103.83.87.185	scanner	55%	DROP	21	3	ssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection	zi13.com	2026-10-16 00:24	evidence →
103.83.87.203	scanner	46%	DROP	13	4	ssh:connectiontelnet:connection	zi14.com	2026-10-11 06:41	evidence →
103.83.87.175	scanner	30%	DROP	8	2	ssh:connectiontelnet:connection	zi12.com	2026-10-11 09:42	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds