IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
56 IPs
Below average
Total Events
5715
Below average by volume
Started / Ended
2026-03-01 14:07 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
125.142.37.91 credential_harvester 83% 1x OSINT 1057 3 ssh:bruteforce — 2026-05-11 07:25 evidence →
152.32.131.112 credential_harvester 81% 1x OSINT 267 3 ssh:bruteforce — 2026-05-11 09:43 evidence →
43.155.21.198 credential_harvester 73% 1x OSINT 728 3 ssh:bruteforce — 2026-05-06 08:47 evidence →
152.32.171.213 credential_harvester 71% 1x OSINT 744 3 ssh:bruteforce — 2026-05-04 16:13 evidence →
211.253.31.30 credential_harvester 65% 512 3 ssh:bruteforce — 2026-04-23 19:54 evidence →
103.144.28.85 credential_harvester 64% 1x OSINT 1394 2 ssh:bruteforce — 2026-05-08 23:41 evidence →
45.61.187.220 credential_harvester 57% 1x OSINT 791 2 ssh:bruteforce node3.anycasthub.com 2026-05-05 11:11 evidence →
152.250.243.47 credential_harvester 56% 1x OSINT 879 2 ssh:bruteforce — 2026-04-29 11:23 evidence →
189.50.142.82 credential_harvester 56% 1x OSINT 750 2 ssh:bruteforce — 2026-04-20 03:47 evidence →
200.77.172.159 credential_harvester 55% 1x OSINT 397 2 ssh:bruteforce 200-77-172-159.cable.dyn.cablevision.net.mx 2026-05-05 08:23 evidence →
5.195.226.17 credential_harvester 55% 1x OSINT 580 2 ssh:bruteforce — 2026-05-02 19:38 evidence →
42.200.66.164 credential_harvester 55% 1x OSINT 399 2 ssh:bruteforce — 2026-04-13 02:02 evidence →
201.71.192.108 credential_harvester 54% 1x OSINT 350 2 ssh:bruteforce — 2026-03-23 04:41 evidence →
140.246.70.45 credential_harvester 54% 1x OSINT 245 2 ssh:bruteforce — 2026-04-17 17:00 evidence →
102.140.97.134 credential_harvester 53% 1x OSINT 142 2 ssh:bruteforce — 2026-03-10 22:06 evidence →
200.108.174.4 credential_harvester 53% 1x OSINT 141 2 ssh:bruteforce 200.108.174.4.vildonettelecom.com.br 2026-03-10 00:38 evidence →
14.103.117.173 credential_harvester 52% 1x OSINT 102 2 ssh:bruteforce — 2026-03-31 23:52 evidence →
158.69.194.34 credential_harvester 52% 1283 2 ssh:bruteforce — 2026-04-20 04:23 evidence →
154.125.147.88 credential_harvester 52% 1071 2 ssh:bruteforce — 2026-03-23 13:24 evidence →
103.76.120.202 credential_harvester 51% 607 2 ssh:bruteforce — 2026-03-21 15:26 evidence →
185.228.135.197 credential_harvester 51% 583 2 ssh:bruteforce — 2026-04-08 03:46 evidence →
156.236.75.188 credential_harvester 50% 518 2 ssh:bruteforce — 2026-03-25 18:56 evidence →
159.146.11.164 credential_harvester 50% 446 2 ssh:bruteforce — 2026-04-08 15:26 evidence →
2.81.52.147 credential_harvester 50% 321 2 ssh:bruteforce — 2026-03-26 01:30 evidence →
101.36.119.222 credential_harvester 49% 291 2 ssh:bruteforce — 2026-03-13 23:08 evidence →
139.59.3.182 credential_harvester 49% 287 2 ssh:bruteforce — 2026-03-15 00:23 evidence →
43.163.206.70 web_probe 49% 12 3 http:scan — 2026-05-09 19:02 evidence →
131.255.240.10 credential_harvester 49% 250 2 ssh:bruteforce — 2026-03-10 18:31 evidence →
87.156.185.48 credential_harvester 49% 247 2 ssh:bruteforce — 2026-03-10 21:31 evidence →
36.50.55.18 credential_harvester 49% 232 2 ssh:bruteforce — 2026-03-11 05:38 evidence →
188.228.212.184 credential_harvester 49% 227 2 ssh:bruteforce — 2026-03-10 12:52 evidence →
182.48.80.240 credential_harvester 49% 209 2 ssh:bruteforce — 2026-03-25 07:43 evidence →
165.227.162.221 credential_harvester 49% 182 2 ssh:bruteforce — 2026-03-19 05:11 evidence →
5.181.124.12 credential_harvester 48% 169 2 ssh:bruteforce — 2026-03-11 00:43 evidence →
210.79.191.216 credential_harvester 48% 169 2 ssh:bruteforce — 2026-03-10 06:53 evidence →
106.58.166.77 credential_harvester 48% 147 2 ssh:bruteforce — 2026-03-13 03:07 evidence →
120.33.126.224 scanner 48% 1x OSINT 28 2 ssh:bruteforce — 2026-03-19 18:32 evidence →
122.176.115.34 credential_harvester 48% 106 2 ssh:bruteforce — 2026-03-26 06:18 evidence →
14.103.206.214 scanner 48% 101 2 ssh:bruteforce — 2026-03-29 11:45 evidence →
181.81.157.200 credential_harvester 47% 73 2 ssh:bruteforce — 2026-03-10 16:24 evidence →
43.130.3.122 web_probe 46% 8 3 http:scan — 2026-05-08 07:13 evidence →
125.132.34.65 interactive_operator 46% 136 2 ssh:bruteforce — 2026-03-13 13:36 evidence →
83.142.209.8 credential_harvester 44% DROP 134 2 ssh:bruteforce — 2026-04-10 18:11 evidence →
85.217.149.63 scanner 40% 12 3 ssh:bruteforce — 2026-05-06 08:26 evidence →
43.157.38.228 web_probe 39% 6 3 http:scan — 2026-04-29 21:15 evidence →
198.144.189.91 opportunistic_bruter 37% 66 2 ssh:bruteforce — 2026-03-11 02:11 evidence →
93.123.109.176 opportunistic_bruter 31% DROP 10 2 ssh:bruteforce — 2026-03-10 22:05 evidence →
14.103.113.53 scanner 28% 1x OSINT 22 2 ssh:bruteforce — 2026-04-16 17:36 evidence →
119.96.174.235 scanner 28% 1x OSINT 13 2 ssh:bruteforce — 2026-05-02 20:10 evidence →
101.36.127.166 credential_harvester 28% 105 2 ssh:bruteforce — 2026-03-10 06:12 evidence →
51.77.145.89 credential_harvester 28% 105 2 ssh:bruteforce vps-cffd66c1.vps.ovh.net 2026-03-10 20:10 evidence →
213.21.239.4 scanner 25% 18 2 ssh:bruteforce — 2026-03-29 12:32 evidence →
43.133.66.51 web_probe 24% 4 2 http:scan — 2026-04-04 03:56 evidence →
205.210.31.109 scanner 23% 12 2 ssh:bruteforce — 2026-03-17 22:51 evidence →
198.235.24.203 scanner 22% 6 2 ssh:bruteforce — 2026-03-10 10:14 evidence →
65.49.1.172 scanner 10% 16 3 http:scanssh:bruteforce scan-73-00.shadowserver.org 2026-04-28 08:49 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds