IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
40 IPs
Below average
Total Events
3486
Below average by volume
Started / Ended
2026-02-23 12:50 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
103.142.26.46 credential_harvester 79% 1x OSINT 1023 3 ssh:bruteforce — 2026-05-08 23:48 evidence →
152.32.171.99 credential_harvester 78% 1x OSINT 1051 3 ssh:bruteforce — 2026-05-08 07:19 evidence →
103.145.63.218 credential_harvester 78% 1x OSINT 475 3 ssh:bruteforce — 2026-05-08 23:53 evidence →
118.193.33.228 credential_harvester 74% 1x OSINT 1025 3 ssh:bruteforce — 2026-05-06 15:43 evidence →
136.232.11.10 credential_harvester 71% 1x OSINT 1000 3 ssh:bruteforce — 2026-05-01 02:19 evidence →
103.153.190.105 credential_harvester 68% 1x OSINT 1175 2 ssh:bruteforce — 2026-05-11 08:29 evidence →
2.57.122.195 opportunistic_bruter 67% DROP1x OSINT 165 3 ssh:bruteforce — 2026-05-11 01:03 evidence →
223.197.186.7 credential_harvester 67% 1x OSINT 434 2 ssh:bruteforce — 2026-05-11 09:56 evidence →
171.244.141.86 credential_harvester 63% 1x OSINT 931 2 ssh:bruteforce — 2026-05-08 12:56 evidence →
213.177.179.80 opportunistic_bruter 59% DROP1x OSINT 3221 3 ssh:bruteforce — 2026-04-30 19:43 evidence →
165.154.1.18 credential_harvester 56% 1x OSINT 1058 2 ssh:bruteforce — 2026-04-30 02:10 evidence →
81.29.142.100 web_probe 56% 134 3 http:scanmysql:bruteforcessh:bruteforce igutic.earnningipti.co.uk 2026-05-06 23:58 evidence →
103.117.56.152 credential_harvester 56% 1x OSINT 802 2 ssh:bruteforce — 2026-04-18 12:33 evidence →
103.67.80.61 credential_harvester 55% 1x OSINT 513 2 ssh:bruteforce — 2026-04-17 12:58 evidence →
180.76.98.88 scanner 54% 1x OSINT 205 2 ssh:bruteforce — 2026-05-02 09:11 evidence →
120.48.106.205 scanner 52% 70 2 ssh:bruteforce — 2026-05-07 22:48 evidence →
210.79.190.31 credential_harvester 52% 1084 2 ssh:bruteforce — 2026-04-21 23:34 evidence →
103.13.206.122 credential_harvester 51% 821 2 ssh:bruteforce — 2026-04-05 14:24 evidence →
199.195.251.10 credential_harvester 50% 508 2 ssh:bruteforce — 2026-03-26 10:21 evidence →
165.227.83.74 credential_harvester 49% 286 2 ssh:bruteforce — 2026-03-18 19:13 evidence →
165.154.6.166 credential_harvester 49% 286 2 ssh:bruteforce — 2026-04-26 19:26 evidence →
116.193.190.100 credential_harvester 49% 281 2 ssh:bruteforce — 2026-04-07 10:01 evidence →
154.82.84.134 credential_harvester 49% 205 2 ssh:bruteforce — 2026-03-19 06:56 evidence →
78.187.21.105 credential_harvester 48% 159 2 ssh:bruteforce — 2026-03-19 00:47 evidence →
14.103.201.200 credential_harvester 47% 58 2 ssh:bruteforce — 2026-04-04 05:21 evidence →
170.106.11.6 web_probe 46% 10 3 http:scan — 2026-05-08 01:59 evidence →
14.103.118.197 scanner 43% 1x OSINT 35 2 ssh:bruteforce — 2026-05-11 20:47 evidence →
77.42.88.138 scanner 40% 453 2 ssh:bruteforce — 2026-03-20 12:52 evidence →
60.219.113.54 scanner 40% 25 2 ssh:bruteforce — 2026-05-07 10:47 evidence →
85.11.183.19 web_probe 34% 19 2 http:scanssh:bruteforce — 2026-05-01 05:04 evidence →
184.105.139.69 scanner 34% 17 2 http:scanssh:bruteforce — 2026-04-27 03:59 evidence →
150.109.46.88 web_probe 24% 6 2 http:scan — 2026-04-30 23:46 evidence →
43.130.67.33 web_probe 24% 5 2 http:scan — 2026-04-20 23:17 evidence →
43.135.172.89 web_probe 23% 3 2 http:scan — 2026-04-10 06:40 evidence →
198.235.24.169 scanner 23% 14 2 ssh:bruteforce — 2026-03-27 05:00 evidence →
216.180.246.147 web_probe 23% 2 2 http:scan — 2026-03-19 14:51 evidence →
91.213.46.177 web_probe 23% 2 2 http:scan — 2026-03-19 09:17 evidence →
92.118.39.30 web_probe 23% DROP 2 2 http:scan — 2026-03-19 07:28 evidence →
180.114.98.111 credential_probe 22% 17 2 ssh:bruteforce — 2026-03-19 05:33 evidence →
207.154.204.127 scanner 21% 4 2 ssh:bruteforce — 2026-03-19 00:16 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds