IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
80 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
80 IPs
Average
Total Events
15411
Below average by volume
Started / Ended
2026-02-28 19:01 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
213.209.159.158 credential_harvester 84% DROP1x OSINT 7600 3 ssh:bruteforce — 2026-05-11 16:45 evidence →
193.46.255.86 credential_harvester 80% DROP1x OSINT 4624 3 ssh:bruteforce — 2026-05-11 12:10 evidence →
156.238.252.133 credential_harvester 71% 1x OSINT 1080 3 ssh:bruteforce — 2026-05-01 13:51 evidence →
103.210.21.178 credential_harvester 71% 1x OSINT 983 3 ssh:bruteforce — 2026-04-29 03:31 evidence →
103.98.176.164 credential_harvester 71% 1x OSINT 878 3 ssh:bruteforce — 2026-05-04 15:34 evidence →
69.5.0.120 credential_harvester 71% 1x OSINT 711 3 ssh:bruteforce — 2026-04-26 21:02 evidence →
94.102.49.155 mysql_bruter 69% DROP1x OSINT 187 3 ftp:bruteforcemysql:bruteforcessh:bruteforce no-reverse-dns-configured.com 2026-05-11 18:12 evidence →
208.69.84.112 credential_harvester 65% 464 3 ssh:bruteforce opvpndmz.dscws.com 2026-04-22 22:41 evidence →
2.57.122.189 opportunistic_bruter 62% DROP1x OSINT 100 3 ssh:bruteforce — 2026-05-09 01:02 evidence →
36.137.249.148 credential_harvester 62% 1x OSINT 271 2 ssh:bruteforce — 2026-05-09 02:08 evidence →
49.64.169.153 scanner 62% 1x OSINT 285 2 ssh:bruteforce — 2026-05-08 23:24 evidence →
122.13.25.186 credential_harvester 62% 1x OSINT 188 2 ssh:bruteforce — 2026-05-09 08:01 evidence →
117.6.44.221 credential_harvester 61% 1x OSINT 1024 2 ssh:bruteforce — 2026-05-07 08:01 evidence →
177.94.206.38 credential_harvester 60% 1x OSINT 432 2 ssh:bruteforce — 2026-05-07 12:20 evidence →
71.6.199.65 scanner 57% 1x OSINT 44 3 ssh:bruteforce — 2026-05-11 13:25 evidence →
121.168.139.251 credential_harvester 56% 1x OSINT 1098 2 ssh:bruteforce — 2026-04-23 19:00 evidence →
72.253.251.3 credential_harvester 56% 1x OSINT 967 2 ssh:bruteforce — 2026-04-28 02:43 evidence →
222.110.147.56 credential_harvester 56% 1x OSINT 963 2 ssh:bruteforce — 2026-05-01 12:24 evidence →
43.154.195.142 credential_harvester 56% 1x OSINT 728 2 ssh:bruteforce — 2026-04-20 22:34 evidence →
61.72.55.130 credential_harvester 56% 1x OSINT 728 2 ssh:bruteforce — 2026-04-28 06:22 evidence →
45.169.200.254 credential_harvester 56% 1x OSINT 714 2 ssh:bruteforce — 2026-04-23 05:15 evidence →
196.28.242.198 credential_harvester 56% 1x OSINT 709 2 ssh:bruteforce — 2026-04-03 20:21 evidence →
51.68.226.87 credential_harvester 55% 1x OSINT 619 2 ssh:bruteforce vps-fc0b2823.vps.ovh.net 2026-04-14 06:16 evidence →
113.193.234.210 credential_harvester 55% 1x OSINT 431 2 ssh:bruteforce — 2026-04-26 18:00 evidence →
176.191.43.176 credential_harvester 55% 1x OSINT 381 2 ssh:bruteforce — 2026-03-20 02:09 evidence →
201.71.192.108 credential_harvester 54% 1x OSINT 350 2 ssh:bruteforce — 2026-03-23 04:41 evidence →
106.75.222.164 credential_harvester 54% 1x OSINT 342 2 ssh:bruteforce — 2026-04-30 20:08 evidence →
14.225.205.58 credential_harvester 54% 1x OSINT 322 2 ssh:bruteforce — 2026-03-28 11:15 evidence →
106.13.100.52 scanner 54% 108 2 ssh:bruteforce — 2026-05-08 10:22 evidence →
106.51.92.114 credential_harvester 51% 855 2 ssh:bruteforce — 2026-05-04 22:08 evidence →
187.212.42.32 credential_harvester 51% 811 2 ssh:bruteforce — 2026-03-18 22:49 evidence →
103.67.78.201 credential_harvester 51% 775 2 ssh:bruteforce — 2026-04-21 15:44 evidence →
103.76.120.202 credential_harvester 51% 607 2 ssh:bruteforce — 2026-03-21 15:26 evidence →
23.227.173.100 credential_harvester 50% 490 2 ssh:bruteforce remote.unkybill-it.com 2026-03-26 17:52 evidence →
190.111.203.33 credential_harvester 50% 479 2 ssh:bruteforce — 2026-03-24 07:56 evidence →
103.76.120.225 credential_harvester 50% 448 2 ssh:bruteforce — 2026-04-22 22:30 evidence →
101.36.112.235 credential_harvester 50% 418 2 ssh:bruteforce — 2026-03-22 01:18 evidence →
220.247.223.56 credential_harvester 50% 384 2 ssh:bruteforce 56.sta.idc-2.slt.lk 2026-03-23 21:19 evidence →
45.175.37.18 credential_harvester 50% 382 2 ssh:bruteforce — 2026-04-23 16:41 evidence →
103.187.147.128 credential_harvester 50% 325 2 ssh:bruteforce — 2026-03-25 23:27 evidence →
134.209.101.17 credential_harvester 50% 316 2 ssh:bruteforce — 2026-04-03 05:06 evidence →
13.81.183.29 credential_harvester 49% 291 2 ssh:bruteforce — 2026-04-02 15:34 evidence →
125.16.27.190 credential_harvester 49% 288 2 ssh:bruteforce — 2026-04-16 04:37 evidence →
195.54.178.243 credential_harvester 49% 278 2 ssh:bruteforce — 2026-03-17 08:01 evidence →
51.15.4.95 interactive_operator 49% 917 2 ssh:bruteforce samfunnssikkerhet.org 2026-03-27 05:50 evidence →
118.145.74.48 scanner 49% 206 2 ssh:bruteforce — 2026-04-05 13:03 evidence →
51.183.250.100 credential_harvester 49% 195 2 ssh:bruteforce — 2026-03-17 09:21 evidence →
134.209.110.133 credential_harvester 49% 187 2 ssh:bruteforce — 2026-03-17 16:22 evidence →
144.217.161.30 credential_harvester 48% 161 2 ssh:bruteforce — 2026-03-16 23:36 evidence →
156.227.237.176 credential_harvester 48% 161 2 ssh:bruteforce — 2026-03-17 19:22 evidence →
13.73.111.251 credential_harvester 48% 151 2 ssh:bruteforce — 2026-03-17 03:42 evidence →
83.97.24.41 credential_harvester 48% 133 2 ssh:bruteforce — 2026-03-17 06:08 evidence →
181.115.147.5 credential_harvester 48% 132 2 ssh:bruteforce — 2026-03-28 03:25 evidence →
69.49.246.176 credential_harvester 48% 114 2 ssh:bruteforce 69-49-246-176.webhostbox.net 2026-03-17 12:11 evidence →
14.103.113.212 scanner 47% 1x OSINT 73 2 ssh:bruteforce — 2026-05-07 23:04 evidence →
113.219.245.57 scanner 47% 72 2 ssh:bruteforce — 2026-03-17 08:58 evidence →
162.62.213.165 web_probe 46% 11 3 http:scan — 2026-05-07 23:40 evidence →
115.190.20.70 data_exfiltrator 42% 18 2 ssh:bruteforce — 2026-03-17 20:26 evidence →
60.219.113.54 scanner 40% 25 2 ssh:bruteforce — 2026-05-07 10:47 evidence →
14.103.114.195 credential_harvester 38% 102 2 ssh:bruteforce — 2026-03-24 20:50 evidence →
85.11.183.25 web_probe 35% 29 2 http:scanssh:bruteforce — 2026-05-02 10:18 evidence →
65.49.1.142 scanner 34% 21 2 http:scanssh:bruteforce — 2026-05-01 07:40 evidence →
164.92.248.125 web_probe 32% 5 2 http:scanssh:bruteforce — 2026-03-17 03:23 evidence →
34.53.234.177 scanner 25% 45 2 ssh:bruteforce — 2026-03-17 09:33 evidence →
89.42.231.182 scanner 25% 42 2 ssh:bruteforce — 2026-03-25 09:44 evidence →
50.217.45.186 credential_probe 24% 51 2 ssh:bruteforce — 2026-03-17 00:05 evidence →
170.64.175.58 scanner 23% 16 2 ssh:bruteforce — 2026-03-17 06:00 evidence →
95.85.234.50 credential_probe 23% 30 2 ssh:bruteforce — 2026-03-17 21:02 evidence →
198.235.24.169 scanner 23% 14 2 ssh:bruteforce — 2026-03-27 05:00 evidence →
170.64.203.213 scanner 23% 12 2 ssh:bruteforce — 2026-03-17 19:45 evidence →
134.199.165.65 scanner 23% 12 2 ssh:bruteforce — 2026-03-17 12:28 evidence →
3.10.242.165 web_probe 23% 2 2 http:scan — 2026-03-17 07:44 evidence →
170.64.138.44 scanner 22% 8 2 ssh:bruteforce — 2026-03-17 17:34 evidence →
142.93.199.193 scanner 22% 8 2 ssh:bruteforce — 2026-03-17 03:17 evidence →
134.199.171.191 scanner 22% 8 2 ssh:bruteforce — 2026-03-17 13:33 evidence →
209.38.83.102 scanner 22% 6 2 ssh:bruteforce — 2026-03-17 05:31 evidence →
18.218.118.203 scanner 10% 1x OSINT 404 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 03:42 evidence →
3.130.168.2 scanner 10% 293 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-09 18:37 evidence →
80.82.70.133 scanner 10% DROP2x OSINT 42 3 ssh:bruteforce rnd.group-ib.com 2026-05-11 18:04 evidence →
51.254.59.113 web_probe 10% 14 3 http:scan scan018.intrinsec.com 2026-05-08 09:50 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds