← Back to feed

Subnet 217.60.242.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (217.60.242.0/24) were observed attacking our sensors within the same time window. All belong to Amin NezhadKahnoji (AS218970). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS218970 · Amin NezhadKahnoji

Subnet

217.60.242.0/24

Country

🇦🇪 AE

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-10-20 16:16 — ongoing

Attack Types

http:scan ssh:connection telnet:connection telnet:intrusion

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Initial Access

T1078 T1190

Execution

T1059.004

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
217.60.242.59	interactive_operator	53%		24	2	telnet:connectiontelnet:intrusion	—	2026-10-22 19:07	evidence →
217.60.242.50	web_probe	34%	1x OSINT	2	2	http:scan	—	2026-10-20 16:36	evidence →
217.60.242.58	scanner	19%		2	1	ssh:connection	—	2026-10-21 02:16	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds