← Back to feed

Subnet 216.226.78.0/24

SUBNET Active high

Why this campaign was detected

3 IPs from the same /24 subnet (216.226.78.0/24) were observed attacking our sensors within the same time window. All belong to Valence Technology Co. (AS50219). Concentrated activity from adjacent IPs is a strong indicator of a single operator or coordinated botnet.

Primary ASN

AS50219 · Valence Technology Co.

Subnet

216.226.78.0/24

Country

🇺🇸 US

Cloud Provider

—

Member Count

3 IPs

Below average

Total Events

Below average by volume

Started / Ended

2026-09-27 14:07 — ongoing

Attack Types

ssh:bruteforce ssh:connection telnet:bruteforce telnet:connection

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.001 T1595.002

Credential Access

T1110 T1110.001

Discovery

T1046

Member Actors

IP Address	Behavior	Confidence	Flags	Events	Agents	Attack Types	Hostname	Last Seen
216.226.78.30	scanner	45%	2x OSINT	17	1	ssh:bruteforcessh:connectiontelnet:bruteforcetelnet:connection	—	2026-10-26 03:22	evidence →
216.226.78.130	scanner	35%		8	2	ssh:connection	—	2026-10-26 16:55	evidence →
216.226.78.113	scanner	20%		4	1	ssh:connection	—	2026-10-23 23:28	evidence →

VPN Known VPN or proxy provider

DROP ASN on Spamhaus DROP list

Nx OSINT Corroborated by N external threat feeds