IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
55 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
55 IPs
Below average
Total Events
7509
Below average by volume
Started / Ended
2026-02-23 17:23 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
213.209.159.158 credential_harvester 84% DROP1x OSINT 7600 3 ssh:bruteforce — 2026-05-11 16:45 evidence →
193.46.255.86 credential_harvester 80% DROP1x OSINT 4624 3 ssh:bruteforce — 2026-05-11 12:10 evidence →
171.244.37.96 credential_harvester 71% 1x OSINT 1243 3 ssh:bruteforce — 2026-05-03 01:12 evidence →
155.248.164.42 credential_harvester 69% 1x OSINT 350 3 ssh:bruteforce — 2026-05-01 07:36 evidence →
222.255.214.79 credential_harvester 67% 1147 3 ssh:bruteforce static.vnpt.vn 2026-05-04 15:19 evidence →
91.134.240.52 credential_harvester 66% 755 3 ssh:bruteforce — 2026-04-27 20:46 evidence →
179.57.170.71 credential_harvester 65% 401 3 ssh:bruteforce — 2026-05-04 20:39 evidence →
2.57.122.190 opportunistic_bruter 63% DROP1x OSINT 110 3 ssh:bruteforce — 2026-05-09 07:04 evidence →
40.83.182.122 credential_harvester 56% 1x OSINT 975 2 ssh:bruteforce — 2026-04-17 17:06 evidence →
138.124.158.150 credential_harvester 56% 1x OSINT 769 2 ssh:bruteforce — 2026-05-02 15:51 evidence →
45.134.9.27 credential_harvester 55% 1x OSINT 587 2 ssh:bruteforce — 2026-04-26 19:53 evidence →
216.155.93.75 credential_harvester 55% 1x OSINT 497 2 ssh:bruteforce — 2026-05-04 09:59 evidence →
203.121.40.210 credential_harvester 55% 1x OSINT 491 2 ssh:bruteforce — 2026-03-24 00:33 evidence →
183.82.111.224 credential_harvester 55% 1x OSINT 346 2 ssh:bruteforce — 2026-05-05 03:51 evidence →
113.193.234.210 credential_harvester 55% 1x OSINT 431 2 ssh:bruteforce — 2026-04-26 18:00 evidence →
113.31.103.129 scanner 53% 1x OSINT 172 2 ssh:bruteforce — 2026-05-04 18:47 evidence →
120.203.25.201 scanner 53% 1x OSINT 134 2 ssh:bruteforce — 2026-04-19 08:44 evidence →
161.132.180.118 credential_harvester 51% 804 2 ssh:bruteforce — 2026-04-23 02:50 evidence →
101.36.108.125 credential_harvester 51% 750 2 ssh:bruteforce — 2026-04-07 16:07 evidence →
103.67.78.70 credential_harvester 51% 722 2 ssh:bruteforce — 2026-03-25 21:24 evidence →
103.63.25.61 credential_harvester 51% 565 2 ssh:bruteforce — 2026-03-26 13:57 evidence →
172.210.249.152 credential_harvester 50% 553 2 ssh:bruteforce — 2026-04-24 20:55 evidence →
188.166.218.64 credential_harvester 50% 477 2 ssh:bruteforce cs.orderkuota.com 2026-03-21 15:50 evidence →
34.122.129.31 credential_harvester 50% 445 2 ssh:bruteforce 31.129.122.34.bc.googleusercontent.com 2026-03-21 22:33 evidence →
45.64.74.51 credential_harvester 50% DROP 384 2 ssh:bruteforce — 2026-03-25 00:51 evidence →
185.196.8.6 credential_harvester 50% 347 2 ssh:bruteforce VPS-Qlaaigpx 2026-03-30 08:52 evidence →
103.187.147.128 credential_harvester 50% 325 2 ssh:bruteforce — 2026-03-25 23:27 evidence →
117.80.146.195 credential_harvester 50% 315 2 ssh:bruteforce — 2026-04-12 18:20 evidence →
172.208.24.217 credential_harvester 49% 300 2 ssh:bruteforce — 2026-03-25 10:00 evidence →
111.119.252.199 credential_harvester 49% 240 2 ssh:bruteforce — 2026-03-15 00:49 evidence →
103.76.120.64 credential_harvester 49% 212 2 ssh:bruteforce — 2026-03-16 20:07 evidence →
152.32.214.167 credential_harvester 48% 167 2 ssh:bruteforce — 2026-03-14 18:22 evidence →
200.225.246.102 credential_harvester 48% 164 2 ssh:bruteforce 200-225-246-102.dynamic.idial.com.br 2026-03-15 07:46 evidence →
180.76.105.16 scanner 48% 154 2 ssh:bruteforce — 2026-04-24 09:38 evidence →
103.174.114.164 credential_harvester 48% 154 2 ssh:bruteforce — 2026-03-15 09:21 evidence →
124.232.199.66 credential_harvester 47% 94 2 ssh:bruteforce — 2026-03-14 16:46 evidence →
124.193.81.23 scanner 47% 78 2 ssh:bruteforce — 2026-04-26 08:23 evidence →
64.227.142.101 interactive_operator 46% 225 2 ssh:bruteforce — 2026-03-14 23:28 evidence →
116.233.56.37 scanner 45% 25 2 ssh:bruteforce — 2026-03-15 05:41 evidence →
106.75.162.193 scanner 42% 20 2 ssh:bruteforce — 2026-03-19 07:11 evidence →
178.156.254.210 reconnaissance 40% 474 2 ssh:bruteforce — 2026-03-16 13:26 evidence →
14.103.114.195 credential_harvester 38% 102 2 ssh:bruteforce — 2026-03-24 20:50 evidence →
103.140.127.215 opportunistic_bruter 32% DROP 15 2 ssh:bruteforce — 2026-04-08 09:45 evidence →
213.209.159.175 web_probe 29% DROP1x OSINT 5 2 http:scan — 2026-03-15 09:51 evidence →
165.154.1.212 credential_harvester 28% 110 2 ssh:bruteforce — 2026-03-15 06:03 evidence →
91.231.89.174 scanner 27% 1x OSINT 11 2 ssh:bruteforce — 2026-05-03 01:43 evidence →
14.103.228.201 scanner 27% 64 2 ssh:bruteforce — 2026-04-13 21:42 evidence →
103.40.14.215 scanner 25% 23 2 ssh:bruteforce — 2026-03-14 19:09 evidence →
217.76.52.30 web_probe 24% 6 2 http:scan — 2026-03-23 22:12 evidence →
164.68.106.39 web_probe 24% 5 2 http:scan — 2026-03-25 00:47 evidence →
137.184.209.158 credential_probe 24% 50 2 ssh:bruteforce — 2026-03-15 02:09 evidence →
43.157.142.101 web_probe 24% 4 2 http:scan — 2026-03-28 11:40 evidence →
43.167.158.184 credential_probe 22% 20 2 ssh:bruteforce — 2026-03-15 12:22 evidence →
31.133.205.10 scanner 21% 4 2 ssh:bruteforce — 2026-03-14 16:45 evidence →
64.62.156.182 scanner 10% 1x OSINT 13 2 http:scanssh:bruteforce scan-86-0.shadowserver.org 2026-04-28 08:50 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds