IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
32 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
32 IPs
Below average
Total Events
23293
Below average by volume
Started / Ended
2026-02-22 16:58 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
51.158.120.121 credential_harvester 81% 1x OSINT 2021 3 ssh:bruteforce 121-120-158-51.instances.scw.cloud 2026-05-09 23:50 evidence →
45.148.10.121 credential_harvester 80% DROP1x OSINT 12474 3 ssh:bruteforce — 2026-05-11 13:24 evidence →
69.5.0.120 credential_harvester 71% 1x OSINT 711 3 ssh:bruteforce — 2026-04-26 21:02 evidence →
94.102.49.155 mysql_bruter 69% DROP1x OSINT 187 3 ftp:bruteforcemysql:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-05-11 18:12 evidence →
80.94.92.171 credential_harvester 64% DROP1x OSINT 3131 3 ssh:bruteforce — 2026-05-11 21:11 evidence →
80.94.92.168 scanner 64% DROP1x OSINT 2132 3 ssh:bruteforce — 2026-05-11 20:10 evidence →
79.124.40.174 web_probe 57% 160 3 http:scan ip-40-174.4vendeta.com 2026-05-11 09:00 evidence →
78.128.112.74 credential_harvester 56% 6845 3 ssh:bruteforce ip-112-74.4vendeta.com 2026-05-04 11:01 evidence →
81.29.142.100 web_probe 56% 134 3 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-05-06 23:58 evidence →
45.169.200.254 credential_harvester 56% 1x OSINT 714 2 ssh:bruteforce — 2026-04-23 05:15 evidence →
45.78.237.21 credential_harvester 50% 388 2 ssh:bruteforce — 2026-04-13 17:27 evidence →
69.12.83.39 credential_harvester 49% 302 2 ssh:bruteforce — 2026-03-16 20:10 evidence →
87.248.237.138 credential_harvester 49% 217 2 ssh:bruteforce 87.248.237.138.pool.sknt.ru 2026-04-12 18:22 evidence →
51.183.250.100 credential_harvester 49% 195 2 ssh:bruteforce — 2026-03-17 09:21 evidence →
83.97.24.41 credential_harvester 48% 133 2 ssh:bruteforce — 2026-03-17 06:08 evidence →
77.90.185.17 proxy_abuser 48% 10660 2 ssh:bruteforce — 2026-04-05 19:17 evidence →
80.94.95.118 proxy_abuser 48% DROP 3080 2 ssh:bruteforce — 2026-04-05 17:04 evidence →
64.89.161.53 credential_harvester 46% DROP 479 2 ssh:bruteforce — 2026-03-16 15:26 evidence →
81.30.212.94 scanner 44% 1x OSINT 38 3 ssh:bruteforce 81.30.212.94.static.ufanet.ru 2026-04-30 23:08 evidence →
92.118.39.95 credential_harvester 42% DROP 7588 2 ssh:bruteforce — 2026-04-16 05:34 evidence →
92.63.197.22 scanner 41% DROP 84 3 ssh:bruteforce — 2026-04-29 10:32 evidence →
85.11.183.25 web_probe 35% 29 2 http:scanssh:bruteforce — 2026-05-02 10:18 evidence →
65.49.1.142 scanner 34% 21 2 http:scanssh:bruteforce — 2026-05-01 07:40 evidence →
91.224.92.50 opportunistic_bruter 34% DROP 45 2 ssh:bruteforce — 2026-04-03 04:02 evidence →
92.118.39.72 credential_harvester 32% DROP 4239 2 ssh:bruteforce — 2026-04-17 15:19 evidence →
92.118.39.76 credential_harvester 32% DROP 4224 2 ssh:bruteforce — 2026-04-18 03:10 evidence →
92.118.39.56 credential_harvester 32% DROP 4100 2 ssh:bruteforce — 2026-04-17 12:10 evidence →
71.6.232.29 scanner 29% 1x OSINT 24 2 ssh:bruteforce — 2026-04-20 12:08 evidence →
58.221.60.25 scanner 28% 99 2 ssh:bruteforce — 2026-03-16 10:18 evidence →
47.104.198.108 scanner 26% 74 2 ssh:bruteforce — 2026-04-25 00:14 evidence →
50.217.45.186 credential_probe 24% 51 2 ssh:bruteforce — 2026-03-17 00:05 evidence →
80.82.70.133 scanner 10% DROP2x OSINT 42 3 ssh:bruteforce rnd.group-ib.com 2026-05-11 18:04 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds