IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
31 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
31 IPs
Below average
Total Events
3379
Below average by volume
Started / Ended
2026-02-27 23:16 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1046
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
89.218.69.66 credential_harvester 71% 1x OSINT 323 3 ssh:bruteforce — 2026-05-05 20:17 evidence →
182.93.7.194 credential_harvester 67% 3879 3 ssh:bruteforce n18293z7l194.static.ctmip.net 2026-04-26 02:14 evidence →
180.76.98.164 scanner 62% 1x OSINT 318 2 ssh:bruteforce — 2026-05-08 19:53 evidence →
203.228.30.198 credential_harvester 56% 1x OSINT 838 2 ssh:bruteforce — 2026-04-17 07:15 evidence →
66.228.53.4 web_probe 56% 46 3 http:scanssh:bruteforce — 2026-05-07 20:27 evidence →
170.233.151.14 credential_harvester 55% 1x OSINT 414 2 ssh:bruteforce — 2026-04-14 14:10 evidence →
123.58.210.86 credential_harvester 55% 1x OSINT 395 2 ssh:bruteforce — 2026-03-21 20:45 evidence →
112.120.171.95 credential_harvester 54% 1x OSINT 200 2 ssh:bruteforce — 2026-04-24 12:25 evidence →
103.63.108.25 credential_harvester 53% 1x OSINT 172 2 ssh:bruteforce — 2026-03-21 00:49 evidence →
172.104.11.4 web_probe 53% 50 3 http:scanssh:bruteforce — 2026-05-06 06:34 evidence →
186.251.71.202 credential_harvester 52% 1053 2 ssh:bruteforce static-186-251-71-202.atnw.com.br 2026-04-20 21:18 evidence →
210.79.191.199 credential_harvester 51% 798 2 ssh:bruteforce mail.gocl.co.id 2026-04-20 23:43 evidence →
101.36.112.235 credential_harvester 50% 418 2 ssh:bruteforce — 2026-03-22 01:18 evidence →
220.247.223.56 credential_harvester 50% 384 2 ssh:bruteforce 56.sta.idc-2.slt.lk 2026-03-23 21:19 evidence →
182.52.109.76 credential_harvester 49% 296 2 ssh:bruteforce — 2026-04-02 00:16 evidence →
118.193.34.157 credential_harvester 49% 293 2 ssh:bruteforce — 2026-03-27 04:44 evidence →
210.79.191.115 credential_harvester 49% 250 2 ssh:bruteforce — 2026-03-21 10:49 evidence →
187.154.126.94 credential_harvester 49% 218 2 ssh:bruteforce — 2026-03-26 09:21 evidence →
34.128.77.56 credential_harvester 49% 209 2 ssh:bruteforce — 2026-03-21 00:49 evidence →
189.147.174.56 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-20 23:11 evidence →
157.10.252.160 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-21 12:12 evidence →
180.106.83.59 scanner 43% 1x OSINT 28 2 ssh:bruteforce — 2026-05-11 15:27 evidence →
49.51.38.193 web_probe 39% 4 3 http:scan — 2026-04-29 17:25 evidence →
85.11.183.25 web_probe 35% 29 2 http:scanssh:bruteforce — 2026-05-02 10:18 evidence →
2.57.121.118 opportunistic_bruter 34% DROP 67 2 ssh:bruteforce — 2026-04-14 13:02 evidence →
2.57.121.50 opportunistic_bruter 34% DROP 65 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
14.103.107.50 scanner 29% 1x OSINT 23 2 ssh:bruteforce — 2026-05-02 15:12 evidence →
147.185.132.195 scanner 28% 1x OSINT 14 2 ssh:bruteforce — 2026-04-21 04:29 evidence →
217.76.52.30 web_probe 24% 6 2 http:scan — 2026-03-23 22:12 evidence →
192.227.159.126 web_probe 23% 2 2 http:scan — 2026-03-21 10:37 evidence →
95.165.15.68 scanner 21% 4 2 ssh:bruteforce — 2026-03-21 11:41 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds