IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
31 IPs independently targeted the same honeypot sensors within a 24-hour window. Hosted on DO. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
DO
Member Count
31 IPs
Below average
Total Events
3402
Below average by volume
Started / Ended
2026-02-25 02:38 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
2.57.121.112 credential_harvester 69% DROP1x OSINT 25910 3 ssh:bruteforce dns112.personaliseplus.com 2026-05-11 21:37 evidence →
213.209.159.159 credential_harvester 68% DROP1x OSINT 23166 3 ssh:bruteforce — 2026-05-01 11:26 evidence →
213.177.179.91 opportunistic_bruter 65% DROP1x OSINT 4898 2 http:scanssh:bruteforce — 2026-05-11 22:54 evidence →
2.57.122.238 credential_harvester 63% DROP1x OSINT 11198 3 ssh:bruteforce — 2026-05-11 06:24 evidence →
213.177.179.62 credential_harvester 59% DROP1x OSINT 8192 3 ssh:bruteforce — 2026-04-28 06:58 evidence →
81.29.142.6 web_probe 57% 109 3 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-05-07 12:54 evidence →
80.66.83.43 scanner 48% 51 3 ssh:bruteforce — 2026-05-09 07:30 evidence →
77.90.185.17 proxy_abuser 48% 10660 2 ssh:bruteforce — 2026-04-05 19:17 evidence →
185.156.73.233 proxy_abuser 48% DROP 4450 2 ssh:bruteforce — 2026-04-05 11:52 evidence →
80.94.95.118 proxy_abuser 48% DROP 3080 2 ssh:bruteforce — 2026-04-05 17:04 evidence →
80.94.95.115 credential_harvester 47% DROP 529 2 ssh:bruteforce — 2026-03-25 18:56 evidence →
80.94.95.116 credential_harvester 46% DROP 469 2 ssh:bruteforce — 2026-03-25 18:32 evidence →
23.160.56.192 data_exfiltrator 44% 72 2 ssh:bruteforce 192so3245.vybrelease.cn.com 2026-02-25 06:28 evidence →
172.214.45.193 reconnaissance 41% 604 2 ssh:bruteforce — 2026-02-24 20:10 evidence →
198.235.24.252 scanner 38% 16 3 ssh:bruteforce — 2026-05-04 22:52 evidence →
178.128.232.91 opportunistic_bruter 31% 10 2 ssh:bruteforce — 2026-02-25 01:25 evidence →
64.227.84.48 credential_harvester 30% 486 2 ssh:bruteforce — 2026-02-25 09:28 evidence →
165.22.161.94 credential_harvester 30% 364 2 ssh:bruteforce — 2026-02-25 07:42 evidence →
167.71.116.66 credential_harvester 28% 141 2 ssh:bruteforce — 2026-02-25 10:41 evidence →
165.227.144.12 credential_harvester 27% 66 2 ssh:bruteforce — 2026-02-25 06:44 evidence →
147.182.189.222 credential_harvester 26% 46 2 ssh:bruteforce — 2026-02-25 10:41 evidence →
138.68.10.1 credential_harvester 26% 36 2 ssh:bruteforce — 2026-02-25 06:38 evidence →
67.205.136.109 credential_harvester 26% 36 2 ssh:bruteforce — 2026-02-25 07:15 evidence →
157.230.171.209 credential_harvester 26% 36 2 ssh:bruteforce — 2026-02-25 07:02 evidence →
47.104.198.108 scanner 26% 74 2 ssh:bruteforce — 2026-04-25 00:14 evidence →
104.248.246.213 credential_harvester 26% 35 2 ssh:bruteforce — 2026-02-25 07:34 evidence →
62.60.131.73 web_probe 24% DROP 7 2 http:scan — 2026-02-26 03:20 evidence →
164.92.176.166 credential_probe 23% 24 2 ssh:bruteforce — 2026-02-25 01:05 evidence →
46.101.109.3 credential_probe 22% 21 2 ssh:bruteforce — 2026-02-25 10:41 evidence →
198.199.86.162 scanner 22% 8 2 ssh:bruteforce — 2026-02-24 09:34 evidence →
18.218.118.203 scanner 10% 1x OSINT 404 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 03:42 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds