IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
52 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
52 IPs
Below average
Total Events
14549
Below average by volume
Started / Ended
2026-03-09 23:49 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
186.96.151.198 credential_harvester 84% 1x OSINT 934 3 ssh:bruteforce — 2026-05-11 22:18 evidence →
81.192.46.32 credential_harvester 84% 1x OSINT 1007 3 ssh:bruteforce — 2026-05-11 18:28 evidence →
163.7.3.26 credential_harvester 77% 1x OSINT 390 3 ssh:bruteforce — 2026-05-09 01:04 evidence →
80.94.92.182 credential_harvester 70% DROP1x OSINT 8855 3 ssh:bruteforce — 2026-05-09 17:07 evidence →
196.0.120.6 credential_harvester 69% 1x OSINT 302 3 ssh:bruteforce — 2026-05-02 04:34 evidence →
173.249.41.171 credential_harvester 67% 1x OSINT 368 2 ssh:bruteforce — 2026-05-11 14:39 evidence →
103.186.0.182 credential_harvester 65% 506 3 ssh:bruteforce — 2026-04-26 21:51 evidence →
2.57.122.194 opportunistic_bruter 62% DROP1x OSINT 165 3 ssh:bruteforce — 2026-05-08 04:03 evidence →
66.228.53.4 web_probe 56% 46 3 http:scanssh:bruteforce — 2026-05-07 20:27 evidence →
197.248.8.33 credential_harvester 55% 1x OSINT 616 2 ssh:bruteforce 197-248-8-33.safaricombusiness.co.ke 2026-04-03 23:12 evidence →
103.187.146.107 credential_harvester 55% 1x OSINT 613 2 ssh:bruteforce mail.balaidkijabar-pelayananpublik.web.id 2026-04-30 08:23 evidence →
213.154.77.61 credential_harvester 54% 1x OSINT 235 2 ssh:bruteforce — 2026-05-04 09:30 evidence →
117.50.70.125 credential_harvester 54% 1x OSINT 215 2 ssh:bruteforce — 2026-04-17 09:53 evidence →
112.120.171.95 credential_harvester 54% 1x OSINT 200 2 ssh:bruteforce — 2026-04-24 12:25 evidence →
66.228.62.150 scanner 52% 1x OSINT 26 3 ssh:bruteforce — 2026-05-09 13:32 evidence →
14.103.117.98 scanner 52% 1x OSINT 79 2 ssh:bruteforce — 2026-04-21 19:25 evidence →
132.145.213.106 credential_harvester 52% 1150 2 ssh:bruteforce — 2026-04-28 18:36 evidence →
199.195.248.191 credential_harvester 51% 926 2 ssh:bruteforce — 2026-04-05 02:50 evidence →
199.195.253.95 credential_harvester 51% 750 2 ssh:bruteforce barkcast.schnauzers.site 2026-04-01 12:00 evidence →
185.239.87.249 credential_harvester 51% DROP 736 2 ssh:bruteforce — 2026-04-18 11:11 evidence →
200.69.236.207 credential_harvester 51% 621 2 ssh:bruteforce — 2026-04-11 04:26 evidence →
103.63.25.61 credential_harvester 51% 565 2 ssh:bruteforce — 2026-03-26 13:57 evidence →
120.62.8.17 credential_harvester 50% 517 2 ssh:bruteforce triband-mum-120.62.8.17.mtnl.net.in 2026-04-13 05:25 evidence →
103.76.120.118 credential_harvester 50% 494 2 ssh:bruteforce — 2026-03-24 18:35 evidence →
103.76.120.225 credential_harvester 50% 448 2 ssh:bruteforce — 2026-04-22 22:30 evidence →
123.58.213.127 credential_harvester 50% 389 2 ssh:bruteforce — 2026-03-25 13:53 evidence →
50.35.168.148 credential_harvester 50% 383 2 ssh:bruteforce — 2026-04-13 04:23 evidence →
165.232.163.9 credential_harvester 50% 341 2 ssh:bruteforce — 2026-03-28 04:13 evidence →
165.154.254.11 credential_harvester 50% DROP 325 2 ssh:bruteforce — 2026-03-24 20:15 evidence →
182.52.109.76 credential_harvester 49% 296 2 ssh:bruteforce — 2026-04-02 00:16 evidence →
201.249.89.102 credential_harvester 49% 292 2 ssh:bruteforce 201-249-89-102-bto-00.rai.cantv.net 2026-03-21 13:07 evidence →
36.255.223.75 credential_harvester 49% 283 2 ssh:bruteforce — 2026-03-21 14:16 evidence →
210.79.191.115 credential_harvester 49% 250 2 ssh:bruteforce — 2026-03-21 10:49 evidence →
178.49.109.109 scanner 49% 193 2 ssh:bruteforce l49-109-109.novotelecom.ru 2026-03-27 01:56 evidence →
180.76.105.16 scanner 48% 154 2 ssh:bruteforce — 2026-04-24 09:38 evidence →
189.90.36.203 credential_harvester 48% 141 2 ssh:bruteforce — 2026-03-21 22:53 evidence →
62.84.186.125 credential_harvester 48% 136 2 ssh:bruteforce — 2026-03-21 20:19 evidence →
185.156.73.233 proxy_abuser 48% DROP 4450 2 ssh:bruteforce — 2026-04-05 11:52 evidence →
64.225.1.77 credential_harvester 47% 96 2 ssh:bruteforce — 2026-03-21 14:25 evidence →
80.94.95.115 credential_harvester 47% DROP 529 2 ssh:bruteforce — 2026-03-25 18:56 evidence →
123.187.241.160 credential_harvester 47% 58 2 ssh:bruteforce 160.241.187.123.broad.ly.ln.dynamic.163data.com.cn 2026-04-20 22:38 evidence →
80.94.95.116 credential_harvester 46% DROP 469 2 ssh:bruteforce — 2026-03-25 18:32 evidence →
157.10.252.160 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-21 12:12 evidence →
49.51.38.193 web_probe 39% 4 3 http:scan — 2026-04-29 17:25 evidence →
2.57.121.118 opportunistic_bruter 34% DROP 67 2 ssh:bruteforce — 2026-04-14 13:02 evidence →
2.57.121.50 opportunistic_bruter 34% DROP 65 2 ssh:bruteforce — 2026-04-11 16:04 evidence →
2.57.121.69 opportunistic_bruter 34% DROP 55 2 ssh:bruteforce — 2026-04-14 19:04 evidence →
14.103.107.50 scanner 29% 1x OSINT 23 2 ssh:bruteforce — 2026-05-02 15:12 evidence →
14.103.228.201 scanner 27% 64 2 ssh:bruteforce — 2026-04-13 21:42 evidence →
216.180.246.191 web_probe 23% 2 2 http:scan — 2026-03-21 14:32 evidence →
192.227.159.126 web_probe 23% 2 2 http:scan — 2026-03-21 10:37 evidence →
95.165.15.68 scanner 21% 4 2 ssh:bruteforce — 2026-03-21 11:41 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds