IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
30 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
30 IPs
Below average
Total Events
1691
Below average by volume
Started / Ended
2026-02-24 09:40 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
141.98.11.83 scanner 77% DROP 17474 3 ssh:bruteforce srv-141-98-11-83.serveroffer.net 2026-05-11 22:46 evidence →
193.32.162.151 credential_harvester 73% DROP1x OSINT 12895 3 ssh:bruteforce — 2026-05-11 10:49 evidence →
103.4.145.50 malware_dropper 63% 163 3 ssh:bruteforce — 2026-04-27 20:03 evidence →
81.29.142.6 web_probe 57% 109 3 http:scanmysql:bruteforcessh:bruteforce chtlvv.rooseveraged.co.uk 2026-05-07 12:54 evidence →
79.124.40.174 web_probe 56% 160 3 http:scan ip-40-174.4vendeta.com 2026-05-11 09:00 evidence →
52.177.169.196 credential_harvester 56% 1x OSINT 745 2 ssh:bruteforce — 2026-04-12 17:19 evidence →
45.164.39.253 credential_harvester 54% 1x OSINT 343 2 ssh:bruteforce — 2026-04-27 00:24 evidence →
45.78.198.177 credential_harvester 54% 1x OSINT 340 2 ssh:bruteforce — 2026-03-22 14:54 evidence →
171.104.143.176 credential_harvester 54% 1x OSINT 294 2 ssh:bruteforce — 2026-05-02 02:52 evidence →
106.13.174.45 scanner 51% 1x OSINT 61 2 ssh:bruteforce — 2026-04-13 17:28 evidence →
88.18.209.3 credential_harvester 50% 486 2 ssh:bruteforce 3.red-88-18-209.staticip.rima-tde.net 2026-03-07 03:40 evidence →
159.89.121.21 credential_harvester 49% 275 2 ssh:bruteforce — 2026-03-06 20:10 evidence →
46.188.119.26 credential_harvester 48% 149 2 ssh:bruteforce broadband-46-188-119-26.2com.net 2026-03-23 03:30 evidence →
148.135.91.131 malware_dropper 47% 69 2 ssh:bruteforce mail.villagepixels.com 2026-03-01 03:26 evidence →
162.241.131.0 opportunistic_bruter 47% 69 2 ssh:bruteforce server.freja-thecat.com 2026-03-01 19:13 evidence →
212.11.64.155 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-02-28 14:05 evidence →
212.11.64.75 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-02-28 07:44 evidence →
156.227.236.246 opportunistic_bruter 46% 33 2 ssh:bruteforce — 2026-02-27 22:32 evidence →
193.106.93.233 scanner 45% 25 2 ssh:bruteforce — 2026-02-28 05:54 evidence →
89.32.41.100 data_exfiltrator 43% 36 2 ssh:bruteforce — 2026-02-28 12:57 evidence →
45.148.10.192 credential_harvester 36% DROP1x OSINT 924 2 ssh:bruteforce — 2026-03-04 10:02 evidence →
36.92.9.2 opportunistic_bruter 36% 40 2 ssh:bruteforce — 2026-03-14 06:45 evidence →
125.212.192.194 scanner 36% 38 2 ssh:bruteforce — 2026-04-16 13:57 evidence →
220.178.8.154 scanner 33% 33 2 ssh:bruteforce — 2026-04-11 12:33 evidence →
176.65.139.12 scanner 28% DROP 288 2 ssh:bruteforce — 2026-02-28 13:11 evidence →
165.154.36.91 web_probe 24% 5 2 http:scan — 2026-04-26 10:57 evidence →
198.235.24.72 scanner 22% 8 2 ssh:bruteforce — 2026-02-28 04:55 evidence →
183.220.237.28 scanner 21% 4 2 ssh:bruteforce — 2026-02-28 09:49 evidence →
18.116.101.220 scanner 10% 1x OSINT 337 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 18:47 evidence →
167.94.146.56 web_probe 10% 4 2 http:scan 56.146.94.167.censys-scanner.com 2026-05-05 18:43 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds