IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
54 IPs
Below average
Total Events
7710
Below average by volume
Started / Ended
2026-03-04 02:35 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
52.172.177.191 credential_harvester 78% 1x OSINT 1318 3 ssh:bruteforce — 2026-05-08 23:50 evidence →
168.167.228.74 credential_harvester 72% 1x OSINT 813 3 ssh:bruteforce — 2026-05-05 20:19 evidence →
89.218.69.66 credential_harvester 71% 1x OSINT 323 3 ssh:bruteforce — 2026-05-05 20:17 evidence →
197.248.8.33 credential_harvester 69% 1x OSINT 856 2 ssh:bruteforce 197-248-8-33.safaricombusiness.co.ke 2026-05-12 02:26 evidence →
182.93.7.194 credential_harvester 67% 3879 3 ssh:bruteforce n18293z7l194.static.ctmip.net 2026-04-26 02:14 evidence →
187.16.96.250 credential_harvester 67% 1781 3 ssh:bruteforce mvx-187-16-96-250.mundivox.com 2026-05-04 09:57 evidence →
187.141.71.166 credential_harvester 65% 1x OSINT 1155 2 ssh:bruteforce customer-187-141-71-166-sta.uninet-ide.com.mx 2026-05-09 19:30 evidence →
122.13.25.186 credential_harvester 61% 1x OSINT 188 2 ssh:bruteforce — 2026-05-09 08:01 evidence →
180.76.98.164 scanner 61% 1x OSINT 318 2 ssh:bruteforce — 2026-05-08 19:53 evidence →
201.149.53.243 credential_harvester 61% 1x OSINT 1003 2 ssh:bruteforce service-static-149.53.243.mcm-telecom.com.mx 2026-05-07 09:30 evidence →
113.193.234.210 credential_harvester 58% 2x OSINT 431 2 ssh:bruteforce — 2026-04-26 18:00 evidence →
79.3.96.178 credential_harvester 58% 2x OSINT 417 2 ssh:bruteforce host-79-3-96-178.business.telecomitalia.it 2026-04-07 23:20 evidence →
172.104.11.4 web_probe 57% 1x OSINT 50 3 http:scanssh:bruteforce — 2026-05-06 06:34 evidence →
103.63.108.25 credential_harvester 57% 2x OSINT 172 2 ssh:bruteforce — 2026-03-21 00:49 evidence →
138.99.80.102 credential_harvester 56% 1x OSINT 1065 2 ssh:bruteforce — 2026-05-03 03:32 evidence →
203.228.30.198 credential_harvester 56% 1x OSINT 838 2 ssh:bruteforce — 2026-04-17 07:15 evidence →
66.228.53.4 web_probe 55% 46 3 http:scanssh:bruteforce — 2026-05-07 20:27 evidence →
81.192.46.32 credential_harvester 55% 1x OSINT 479 2 ssh:bruteforce — 2026-04-22 21:37 evidence →
170.233.151.14 credential_harvester 55% 1x OSINT 414 2 ssh:bruteforce — 2026-04-14 14:10 evidence →
123.58.210.86 credential_harvester 55% 1x OSINT 395 2 ssh:bruteforce — 2026-03-21 20:45 evidence →
103.203.57.11 scanner 54% 70 3 ssh:bruteforce scan-57-11.security.ipip.net 2026-05-12 03:09 evidence →
117.50.70.125 credential_harvester 54% 1x OSINT 215 2 ssh:bruteforce — 2026-04-17 09:53 evidence →
180.76.98.88 scanner 54% 1x OSINT 205 2 ssh:bruteforce — 2026-05-02 09:11 evidence →
112.120.171.95 credential_harvester 54% 1x OSINT 200 2 ssh:bruteforce — 2026-04-24 12:25 evidence →
183.232.212.207 scanner 52% 1x OSINT 78 2 ssh:bruteforce — 2026-04-28 15:33 evidence →
221.159.150.85 credential_harvester 52% 1348 2 ssh:bruteforce — 2026-04-14 03:26 evidence →
103.13.207.34 credential_harvester 52% 1082 2 ssh:bruteforce — 2026-04-21 02:36 evidence →
210.79.191.199 credential_harvester 51% 798 2 ssh:bruteforce mail.gocl.co.id 2026-04-20 23:43 evidence →
103.49.238.236 credential_harvester 51% 737 2 ssh:bruteforce — 2026-03-24 23:38 evidence →
14.18.113.233 scanner 51% 1x OSINT 44 2 ssh:bruteforce — 2026-05-03 14:05 evidence →
103.76.120.118 credential_harvester 50% 494 2 ssh:bruteforce — 2026-03-24 18:35 evidence →
188.166.218.64 credential_harvester 50% 477 2 ssh:bruteforce cs.orderkuota.com 2026-03-21 15:50 evidence →
101.36.112.235 credential_harvester 50% 418 2 ssh:bruteforce — 2026-03-22 01:18 evidence →
220.247.223.56 credential_harvester 50% 384 2 ssh:bruteforce 56.sta.idc-2.slt.lk 2026-03-23 21:19 evidence →
207.154.227.150 credential_harvester 50% 346 2 ssh:bruteforce — 2026-03-21 00:42 evidence →
182.52.109.76 credential_harvester 49% 296 2 ssh:bruteforce — 2026-04-02 00:16 evidence →
118.193.34.157 credential_harvester 49% 293 2 ssh:bruteforce — 2026-03-27 04:44 evidence →
210.79.191.115 credential_harvester 49% 250 2 ssh:bruteforce — 2026-03-21 10:49 evidence →
187.154.126.94 credential_harvester 49% 218 2 ssh:bruteforce — 2026-03-26 09:21 evidence →
34.128.77.56 credential_harvester 49% 209 2 ssh:bruteforce — 2026-03-21 00:49 evidence →
178.49.109.109 scanner 49% 193 2 ssh:bruteforce l49-109-109.novotelecom.ru 2026-03-27 01:56 evidence →
189.147.174.56 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-20 23:11 evidence →
49.51.38.193 web_probe 39% 4 3 http:scan — 2026-04-29 17:25 evidence →
85.11.183.25 web_probe 35% 29 2 http:scanssh:bruteforce — 2026-05-02 10:18 evidence →
2.57.121.118 opportunistic_bruter 34% DROP 67 2 ssh:bruteforce — 2026-04-14 13:02 evidence →
2.57.121.50 opportunistic_bruter 34% DROP 65 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
14.103.107.50 scanner 32% 2x OSINT 23 2 ssh:bruteforce — 2026-05-02 15:12 evidence →
147.185.132.195 scanner 31% 2x OSINT 14 2 ssh:bruteforce — 2026-04-21 04:29 evidence →
14.103.76.234 credential_probe 24% 60 2 ssh:bruteforce — 2026-03-20 16:30 evidence →
217.76.52.30 web_probe 24% 6 2 http:scan — 2026-03-23 22:12 evidence →
192.227.159.126 web_probe 23% 2 2 http:scan — 2026-03-21 10:37 evidence →
45.87.249.40 scanner 22% 8 2 ssh:bruteforce — 2026-03-20 16:42 evidence →
95.165.15.68 scanner 21% 4 2 ssh:bruteforce — 2026-03-21 11:41 evidence →
3.134.216.108 scanner 10% 2x OSINT 184 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-09 17:38 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds