IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
56 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
56 IPs
Below average
Total Events
24094
Below average by volume
Started / Ended
2026-03-02 16:35 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
187.210.77.100 credential_harvester 81% 1x OSINT 1986 3 ssh:bruteforce customer-187-210-77-100.uninet-ide.com.mx 2026-05-09 23:59 evidence →
154.83.196.237 credential_harvester 80% 1x OSINT 175 3 ssh:bruteforce — 2026-05-11 09:26 evidence →
125.21.59.218 credential_harvester 77% 1x OSINT 1347 3 ssh:bruteforce — 2026-05-07 22:05 evidence →
102.211.152.138 credential_harvester 76% 1x OSINT 1005 3 ssh:bruteforce — 2026-05-07 09:42 evidence →
185.40.30.168 credential_harvester 65% 1x OSINT 932 2 ssh:bruteforce — 2026-05-09 23:17 evidence →
14.103.104.36 credential_harvester 57% 1x OSINT 181 2 ssh:bruteforce — 2026-05-07 03:42 evidence →
103.190.214.241 credential_harvester 56% 1x OSINT 1087 2 ssh:bruteforce — 2026-05-02 22:12 evidence →
103.250.11.118 credential_harvester 56% 1x OSINT 815 2 ssh:bruteforce — 2026-04-16 14:02 evidence →
183.250.89.44 scanner 56% 1x OSINT 108 2 ssh:bruteforce — 2026-05-06 14:40 evidence →
64.62.197.182 scanner 55% 23 3 http:scanssh:bruteforce — 2026-05-08 06:31 evidence →
203.121.40.210 credential_harvester 55% 1x OSINT 491 2 ssh:bruteforce — 2026-03-24 00:33 evidence →
14.103.127.233 credential_harvester 53% 1x OSINT 191 2 ssh:bruteforce — 2026-05-01 20:36 evidence →
43.159.149.216 web_probe 52% 8 3 http:scan — 2026-05-11 20:18 evidence →
120.48.29.51 scanner 52% 1x OSINT 33 2 ssh:bruteforce — 2026-05-11 06:32 evidence →
125.75.110.72 scanner 51% 1x OSINT 60 2 ssh:bruteforce — 2026-03-13 11:26 evidence →
118.219.239.123 credential_harvester 51% 738 2 ssh:bruteforce — 2026-04-22 12:48 evidence →
42.96.43.148 credential_harvester 51% 638 2 ssh:bruteforce — 2026-04-24 22:33 evidence →
103.76.120.118 credential_harvester 50% 494 2 ssh:bruteforce — 2026-03-24 18:35 evidence →
157.97.107.143 credential_harvester 50% 434 2 ssh:bruteforce — 2026-03-21 22:59 evidence →
31.59.102.138 credential_harvester 50% 386 2 ssh:bruteforce — 2026-03-18 15:53 evidence →
45.175.37.18 credential_harvester 50% 382 2 ssh:bruteforce — 2026-04-23 16:41 evidence →
112.78.10.55 credential_harvester 49% 306 2 ssh:bruteforce — 2026-04-15 17:43 evidence →
14.103.145.231 scanner 49% 1x OSINT 65 3 ssh:bruteforce — 2026-05-06 11:28 evidence →
125.247.116.158 credential_harvester 49% 295 2 ssh:bruteforce — 2026-04-02 15:11 evidence →
129.226.172.185 credential_harvester 49% 294 2 ssh:bruteforce — 2026-03-25 15:53 evidence →
103.59.94.19 credential_harvester 49% 276 2 ssh:bruteforce — 2026-04-07 22:13 evidence →
196.29.34.170 credential_harvester 49% 270 2 ssh:bruteforce — 2026-03-27 08:30 evidence →
197.211.55.20 credential_harvester 49% 249 2 ssh:bruteforce — 2026-03-25 21:01 evidence →
103.13.206.154 credential_harvester 49% 246 2 ssh:bruteforce — 2026-03-23 20:32 evidence →
105.27.148.94 credential_harvester 49% 222 2 ssh:bruteforce — 2026-03-27 23:08 evidence →
72.144.12.31 credential_harvester 49% 222 2 ssh:bruteforce — 2026-03-30 04:38 evidence →
103.59.94.82 credential_harvester 49% 211 2 ssh:bruteforce — 2026-03-29 05:16 evidence →
37.187.244.59 credential_harvester 49% 205 2 ssh:bruteforce vps-226c7f3b.vps.ovh.net 2026-03-12 19:51 evidence →
137.74.46.5 credential_harvester 49% 187 2 ssh:bruteforce vps-e3facb1b.vps.ovh.net 2026-03-13 04:45 evidence →
92.191.96.115 credential_harvester 49% 187 2 ssh:bruteforce 115.96.191.92.dynamic.jazztel.es 2026-03-13 01:45 evidence →
165.227.3.79 credential_harvester 48% 128 2 ssh:bruteforce — 2026-03-13 09:25 evidence →
120.48.170.78 credential_harvester 48% 125 2 ssh:bruteforce — 2026-03-21 20:02 evidence →
112.28.234.150 credential_harvester 48% 119 2 ssh:bruteforce — 2026-03-13 16:49 evidence →
124.221.107.161 credential_harvester 47% 61 2 ssh:bruteforce — 2026-03-13 07:12 evidence →
180.184.160.202 scanner 46% 46 2 ssh:bruteforce — 2026-03-12 20:18 evidence →
116.255.159.84 scanner 46% 38 2 ssh:bruteforce — 2026-03-20 02:01 evidence →
186.96.145.241 credential_harvester 42% 31771 2 ssh:bruteforce — 2026-04-23 10:04 evidence →
14.103.84.166 scanner 40% 1x OSINT 25 2 ssh:bruteforce — 2026-04-24 01:48 evidence →
58.216.53.130 scanner 35% 24 2 ssh:bruteforce — 2026-03-31 06:31 evidence →
91.224.92.50 opportunistic_bruter 34% DROP 45 2 ssh:bruteforce — 2026-04-03 04:02 evidence →
142.93.160.46 credential_harvester 26% 36 2 ssh:bruteforce — 2026-03-12 20:08 evidence →
115.190.245.176 scanner 25% 26 2 ssh:bruteforce — 2026-03-13 05:59 evidence →
34.61.82.184 web_probe 25% 8 2 http:scan — 2026-03-30 14:12 evidence →
14.103.179.212 scanner 25% 17 2 ssh:bruteforce — 2026-03-23 07:26 evidence →
197.248.204.18 web_probe 24% 4 2 http:scan — 2026-03-12 22:16 evidence →
45.156.129.52 web_probe 23% 3 2 http:scan — 2026-04-25 12:06 evidence →
154.219.103.140 credential_probe 23% DROP 30 2 ssh:bruteforce — 2026-03-13 05:37 evidence →
123.160.223.74 web_probe 23% 2 2 http:scan — 2026-03-13 00:42 evidence →
60.178.172.13 scanner 22% 6 2 ssh:bruteforce — 2026-03-13 14:09 evidence →
3.143.162.210 scanner 10% 121 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 19:03 evidence →
65.49.1.24 scanner 10% 14 2 http:scanssh:bruteforce scan-53a.shadowserver.org 2026-04-15 14:42 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds