← Back to feed

Subnet 34.156.220.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (34.156.220.0/24) were observed attacking our sensors within the same time window. All belong to Google LLC (AS396982). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS396982 · Google LLC

Subnet

34.156.220.0/24

Country

🇧🇪 BE

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

156

Below average by volume

Started / Ended

2026-10-08 06:00 — ongoing

Attack Types

ftp:bruteforce ssh:bruteforce ssh:connection telnet:bruteforce telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Events	Agents	Attack Types	Hostname	Last Seen
34.156.220.171	scanner	38%	69	2	ftp:bruteforcetelnet:bruteforcetelnet:connection	171.220.156.34.bc.googleusercontent.com	2026-10-13 04:23	evidence →
34.156.220.173	scanner	32%	19	2	ssh:bruteforcessh:connection	173.220.156.34.bc.googleusercontent.com	2026-10-16 04:52	evidence →
34.156.220.162	scanner	19%	68	1	telnet:bruteforcetelnet:connection	162.220.156.34.bc.googleusercontent.com	2026-10-09 11:26	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds