← Back to feed

Subnet 31.184.195.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (31.184.195.0/24) were observed attacking our sensors within the same time window. All belong to Petersburg Internet Network ltd. (AS34665). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS34665 · Petersburg Internet Network ltd.

Subnet

31.184.195.0/24

Country

🇷🇺 RU

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-09-18 09:28 — ongoing

Attack Types

ftp:bruteforce mysql:bruteforce ssh:connection telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
31.184.195.246	mysql_bruter	70%	2x OSINT	39	4	ftp:bruteforcemysql:bruteforcessh:connectiontelnet:connection	gitati.info	2026-10-20 13:08	evidence →
31.184.195.248	scanner	60%	1x OSINT	19	4	ssh:connectiontelnet:connection	—	2026-10-18 08:36	evidence →
31.184.195.244	scanner	40%	1x OSINT	8	2	ssh:connection	—	2026-10-20 17:30	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds