← Back to feed
216.180.246.13
KNOWN SCANNER TAGGED BENIGN how we decide →
Why: Known research scanner (Nokia Deepfield), inside the IP ranges it publishes
crawler013.deepfield.net
(deepfield.net)
✓ FCrDNS
Assessment
- Active for 11 days, 2026-09-25 to 2026-10-07.
- Part of a 283-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇺🇸 US
ASN
AS396982 · Google LLC
Cloud Provider
—
Scanner Organization
Nokia Deepfield
per its published IP ranges
Total Events
4
Below average by volume
Agent Count
3
First / Last Seen
2026-09-25 08:04 — 2026-10-07 07:50
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan
SCAN
Active
medium
207 IPs
672905 events
2026-10-04 — ongoing · 207 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
116 IPs
164689 events
2026-09-26 — ongoing · 116 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
202 IPs
642473 events
2026-09-24 — ongoing · 202 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
237 IPs
539996 events
2026-09-24 — ongoing · 237 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
283 IPs
597549 events
2026-09-22 — ongoing · 283 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
211 IPs
311701 events
2026-09-22 — ongoing · 211 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
130 IPs
349914 events
2026-09-22 — ongoing · 130 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
221 IPs
517346 events
2026-09-09 — ongoing · 221 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
189 IPs
465066 events
2026-09-07 — ongoing · 189 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
171 IPs
416944 events
2026-08-17 — ongoing · 171 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
162 IPs
548258 events
2026-07-27 — ongoing · 162 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
163 IPs
268735 events
2026-07-14 — ongoing · 163 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
80 IPs
213071 events
2026-05-27 — ongoing · 80 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
145 IPs
462151 events
2026-05-24 — ongoing · 145 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
188 IPs
549702 events
2026-05-13 — ongoing · 188 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
183 IPs
636780 events
2026-04-15 — ongoing · 183 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
229 IPs
765863 events
2026-04-13 — ongoing · 229 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
177 IPs
628041 events
2026-04-13 — ongoing · 177 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
113 IPs
56956 events
2026-04-02 — ongoing · 113 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
4 IPs
1212 events
2026-03-31 — ongoing · 4 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
98 IPs
46574 events
2026-03-31 — ongoing · 98 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
120 IPs
214812 events
2026-03-28 — ongoing · 120 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
144 IPs
299424 events
2026-03-22 — ongoing · 144 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on Linode. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
233 IPs
759513 events
2026-03-21 — ongoing · 233 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
208 IPs
743726 events
2026-03-21 — ongoing · 208 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
129 IPs
278980 events
2026-03-21 — ongoing · 129 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
214 IPs
435545 events
2026-03-07 — ongoing · 214 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
141 IPs
137287 events
2026-03-07 — ongoing · 141 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
264 IPs
713803 events
2026-03-07 — ongoing · 264 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
18 IPs
12747 events
2026-03-07 — ongoing · 18 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same …
Multi-Agent Scan
SCAN
Active
medium
32 IPs
24794 events
2026-03-04 — ongoing · 32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
226 IPs
567472 events
2026-03-01 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
263 IPs
675998 events
2026-03-01 — ongoing · 263 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
218 IPs
599943 events
2026-03-01 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
252 IPs
619688 events
2026-03-01 — ongoing · 252 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
266 IPs
509435 events
2026-03-01 — ongoing · 266 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
274 IPs
501286 events
2026-03-01 — ongoing · 274 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
236 IPs
719808 events
2026-02-27 — ongoing · 236 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
197 IPs
400233 events
2026-02-27 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
250 IPs
529731 events
2026-02-26 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
113 IPs
406757 events
2026-02-26 — ongoing · 113 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan
SCAN
Active
medium
166 IPs
545950 events
2026-02-25 — ongoing · 166 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Subnet 216.180.246.0/24
SUBNET
Ended
high
🇺🇸 US
20 IPs
205 events
http:scanssh:connectiontelnet:connection
2026-02-20 — ongoing · 20 IPs from the same /24 subnet (216.180.246.0/24) were observed attacking our sensors within the same time window. …
Session Forensics
Sessions
4
Avg Depth Score
0.25
Commands Executed
0
Files Downloaded
0
Evidence Timeline
Web Probe
461e0a4778b23391
25%
Loading events...
Web Probe
0d04657e805c8848
25%
Loading events...
Web Probe
6dafbaf22f92c3e6
25%
Loading events...
Web Probe
6efaa1c3c7b12b14
25%
Loading events...
Non-Session Events
| Timestamp | Port | Proto | Event | Source | Location |
|---|---|---|---|---|---|
| 2026-10-07 07:50:25 | :80 | http | HTTP GET request | opencanary | phx |
| 2026-10-03 03:19:27 | :80 | http | HTTP GET request | opencanary | sin |
| 2026-09-28 08:13:24 | :80 | http | HTTP GET request | opencanary | phx |
| 2026-09-25 08:04:51 | :80 | http | HTTP GET request | opencanary | sea |