IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
30 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
30 IPs
Below average
Total Events
3662
Below average by volume
Started / Ended
2026-02-22 17:05 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
2.57.121.112 credential_harvester 69% DROP1x OSINT 25910 3 ssh:bruteforce dns112.personaliseplus.com 2026-05-11 21:37 evidence →
213.209.159.159 credential_harvester 68% DROP1x OSINT 23166 3 ssh:bruteforce — 2026-05-01 11:26 evidence →
213.177.179.91 opportunistic_bruter 65% DROP1x OSINT 4898 2 http:scanssh:bruteforce — 2026-05-11 22:54 evidence →
81.29.142.6 web_probe 57% 109 3 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-05-07 12:54 evidence →
77.90.185.17 proxy_abuser 48% 10660 2 ssh:bruteforce — 2026-04-05 19:17 evidence →
185.156.73.233 proxy_abuser 48% DROP 4450 2 ssh:bruteforce — 2026-04-05 11:52 evidence →
80.94.95.118 proxy_abuser 48% DROP 3080 2 ssh:bruteforce — 2026-04-05 17:04 evidence →
174.101.165.67 credential_probe 47% 48 3 http:scanssh:bruteforce syn-174-101-165-067.res.spectrum.com 2026-04-22 21:52 evidence →
80.94.95.115 credential_harvester 47% DROP 529 2 ssh:bruteforce — 2026-03-25 18:56 evidence →
80.94.95.116 credential_harvester 46% DROP 469 2 ssh:bruteforce — 2026-03-25 18:32 evidence →
172.214.45.193 reconnaissance 41% 604 2 ssh:bruteforce — 2026-02-24 20:10 evidence →
198.235.24.252 scanner 38% 16 3 ssh:bruteforce — 2026-05-04 22:52 evidence →
64.62.197.47 scanner 38% 1x OSINT 13 2 http:scanssh:bruteforce — 2026-03-27 04:55 evidence →
45.148.10.192 credential_harvester 36% DROP1x OSINT 924 2 ssh:bruteforce — 2026-03-04 10:02 evidence →
178.128.232.91 opportunistic_bruter 31% 10 2 ssh:bruteforce — 2026-02-25 01:25 evidence →
64.227.84.48 credential_harvester 30% 486 2 ssh:bruteforce — 2026-02-25 09:28 evidence →
165.22.161.94 credential_harvester 30% 364 2 ssh:bruteforce — 2026-02-25 07:42 evidence →
167.71.116.66 credential_harvester 28% 141 2 ssh:bruteforce — 2026-02-25 10:41 evidence →
165.227.144.12 credential_harvester 27% 66 2 ssh:bruteforce — 2026-02-25 06:44 evidence →
147.182.189.222 credential_harvester 26% 46 2 ssh:bruteforce — 2026-02-25 10:41 evidence →
67.205.136.109 credential_harvester 26% 36 2 ssh:bruteforce — 2026-02-25 07:15 evidence →
157.230.171.209 credential_harvester 26% 36 2 ssh:bruteforce — 2026-02-25 07:02 evidence →
138.68.10.1 credential_harvester 26% 36 2 ssh:bruteforce — 2026-02-25 06:38 evidence →
47.104.198.108 scanner 26% 74 2 ssh:bruteforce — 2026-04-25 00:14 evidence →
104.248.246.213 credential_harvester 26% 35 2 ssh:bruteforce — 2026-02-25 07:34 evidence →
62.60.131.73 web_probe 24% DROP 7 2 http:scan — 2026-02-26 03:20 evidence →
164.92.176.166 credential_probe 23% 24 2 ssh:bruteforce — 2026-02-25 01:05 evidence →
46.101.109.3 credential_probe 22% 21 2 ssh:bruteforce — 2026-02-25 10:41 evidence →
18.218.118.203 scanner 10% 1x OSINT 404 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 03:42 evidence →
64.62.197.95 scanner 10% 1x OSINT 5 2 http:scanssh:bruteforce scan-39d.shadowserver.org 2026-02-25 11:30 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds