IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
50 IPs
Below average
Total Events
5331
Below average by volume
Started / Ended
2026-02-22 17:04 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
163.7.3.26 credential_harvester 81% 2x OSINT 390 3 ssh:bruteforce — 2026-05-09 01:04 evidence →
101.32.240.31 credential_harvester 76% 1x OSINT 472 3 ssh:bruteforce — 2026-05-08 07:48 evidence →
168.167.228.74 credential_harvester 72% 1x OSINT 813 3 ssh:bruteforce — 2026-05-05 20:19 evidence →
89.218.69.66 credential_harvester 71% 1x OSINT 323 3 ssh:bruteforce — 2026-05-05 20:17 evidence →
103.186.0.182 credential_harvester 65% 506 3 ssh:bruteforce — 2026-04-26 21:51 evidence →
45.148.10.141 opportunistic_bruter 64% DROP1x OSINT 144 3 ssh:bruteforce — 2026-05-09 16:03 evidence →
35.188.112.111 credential_harvester 63% 2x OSINT 466 2 ssh:bruteforce — 2026-05-07 10:40 evidence →
171.244.141.86 credential_harvester 63% 1x OSINT 931 2 ssh:bruteforce — 2026-05-08 12:56 evidence →
2.57.122.189 opportunistic_bruter 62% DROP1x OSINT 100 3 ssh:bruteforce — 2026-05-09 01:02 evidence →
2.57.122.195 opportunistic_bruter 61% DROP1x OSINT 160 3 ssh:bruteforce — 2026-05-08 07:04 evidence →
172.104.11.4 web_probe 57% 1x OSINT 50 3 http:scanssh:bruteforce — 2026-05-06 06:34 evidence →
103.63.108.25 credential_harvester 57% 2x OSINT 172 2 ssh:bruteforce — 2026-03-21 00:49 evidence →
138.99.80.102 credential_harvester 56% 1x OSINT 1065 2 ssh:bruteforce — 2026-05-03 03:32 evidence →
203.228.30.198 credential_harvester 56% 1x OSINT 838 2 ssh:bruteforce — 2026-04-17 07:15 evidence →
66.228.53.4 web_probe 55% 46 3 http:scanssh:bruteforce — 2026-05-07 20:27 evidence →
170.233.151.14 credential_harvester 55% 1x OSINT 414 2 ssh:bruteforce — 2026-04-14 14:10 evidence →
123.58.210.86 credential_harvester 55% 1x OSINT 395 2 ssh:bruteforce — 2026-03-21 20:45 evidence →
180.76.98.88 scanner 54% 1x OSINT 205 2 ssh:bruteforce — 2026-05-02 09:11 evidence →
112.120.171.95 credential_harvester 54% 1x OSINT 200 2 ssh:bruteforce — 2026-04-24 12:25 evidence →
103.13.207.34 credential_harvester 52% 1082 2 ssh:bruteforce — 2026-04-21 02:36 evidence →
210.79.191.199 credential_harvester 51% 798 2 ssh:bruteforce mail.gocl.co.id 2026-04-20 23:43 evidence →
103.49.238.236 credential_harvester 51% 737 2 ssh:bruteforce — 2026-03-24 23:38 evidence →
60.244.155.70 credential_harvester 51% 658 2 ssh:bruteforce — 2026-03-29 04:50 evidence →
101.36.112.235 credential_harvester 50% 418 2 ssh:bruteforce — 2026-03-22 01:18 evidence →
220.247.223.56 credential_harvester 50% 384 2 ssh:bruteforce 56.sta.idc-2.slt.lk 2026-03-23 21:19 evidence →
165.154.254.11 credential_harvester 50% DROP 325 2 ssh:bruteforce — 2026-03-24 20:15 evidence →
103.189.235.33 credential_harvester 50% 323 2 ssh:bruteforce — 2026-04-15 03:14 evidence →
182.52.109.76 credential_harvester 49% 296 2 ssh:bruteforce — 2026-04-02 00:16 evidence →
118.193.34.157 credential_harvester 49% 293 2 ssh:bruteforce — 2026-03-27 04:44 evidence →
36.255.223.75 credential_harvester 49% 283 2 ssh:bruteforce — 2026-03-21 14:16 evidence →
187.154.126.94 credential_harvester 49% 218 2 ssh:bruteforce — 2026-03-26 09:21 evidence →
34.128.77.56 credential_harvester 49% 209 2 ssh:bruteforce — 2026-03-21 00:49 evidence →
189.90.36.203 credential_harvester 48% 141 2 ssh:bruteforce — 2026-03-21 22:53 evidence →
64.225.1.77 credential_harvester 47% 96 2 ssh:bruteforce — 2026-03-21 14:25 evidence →
189.147.174.56 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-20 23:11 evidence →
80.94.95.115 credential_harvester 47% DROP 529 2 ssh:bruteforce — 2026-03-25 18:56 evidence →
157.10.252.160 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-21 12:12 evidence →
80.94.95.221 scanner 46% DROP1x OSINT 101 3 ssh:bruteforce — 2026-04-29 07:24 evidence →
49.51.38.193 web_probe 39% 4 3 http:scan — 2026-04-29 17:25 evidence →
2.57.121.118 opportunistic_bruter 34% DROP 67 2 ssh:bruteforce — 2026-04-14 13:02 evidence →
2.57.121.50 opportunistic_bruter 34% DROP 65 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
2.57.121.69 opportunistic_bruter 34% DROP 55 2 ssh:bruteforce — 2026-04-14 19:04 evidence →
14.103.107.50 scanner 32% 2x OSINT 23 2 ssh:bruteforce — 2026-05-02 15:12 evidence →
147.185.132.195 scanner 31% 2x OSINT 14 2 ssh:bruteforce — 2026-04-21 04:29 evidence →
180.106.83.59 scanner 30% 1x OSINT 26 2 ssh:bruteforce — 2026-04-05 00:09 evidence →
216.180.246.191 web_probe 23% 2 2 http:scan — 2026-03-21 14:32 evidence →
192.227.159.126 web_probe 23% 2 2 http:scan — 2026-03-21 10:37 evidence →
45.87.249.40 scanner 22% 8 2 ssh:bruteforce — 2026-03-20 16:42 evidence →
95.165.15.68 scanner 21% 4 2 ssh:bruteforce — 2026-03-21 11:41 evidence →
3.134.216.108 scanner 10% 2x OSINT 184 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-09 17:38 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds