IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
31 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
31 IPs
Below average
Total Events
5458
Below average by volume
Started / Ended
2026-03-11 05:55 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
14.63.217.28 credential_harvester 76% 1x OSINT 1293 3 ssh:bruteforce — 2026-05-07 16:52 evidence →
103.98.176.164 credential_harvester 71% 1x OSINT 878 3 ssh:bruteforce — 2026-05-04 15:34 evidence →
68.183.236.1 credential_harvester 70% 1x OSINT 558 3 ssh:bruteforce — 2026-05-04 12:39 evidence →
43.245.97.82 credential_harvester 66% 1x OSINT 334 2 ssh:bruteforce v097082.serveradd.com 2026-05-11 04:41 evidence →
198.98.55.71 credential_harvester 63% 1x OSINT 1136 2 ssh:bruteforce — 2026-05-08 14:37 evidence →
152.32.238.146 credential_harvester 63% 1x OSINT 1381 2 ssh:bruteforce — 2026-05-08 12:40 evidence →
209.141.41.212 credential_harvester 56% 1x OSINT 1049 2 ssh:bruteforce — 2026-04-21 22:36 evidence →
72.253.251.3 credential_harvester 56% 1x OSINT 967 2 ssh:bruteforce — 2026-04-28 02:43 evidence →
171.25.158.74 credential_harvester 56% 1x OSINT 869 2 ssh:bruteforce — 2026-05-03 06:57 evidence →
45.79.181.223 web_probe 56% 24 3 http:scanssh:bruteforce — 2026-05-08 11:27 evidence →
152.32.253.205 credential_harvester 55% 1x OSINT 624 2 ssh:bruteforce — 2026-04-25 01:12 evidence →
45.78.198.228 credential_harvester 55% 1x OSINT 482 2 ssh:bruteforce — 2026-04-29 10:16 evidence →
120.48.181.192 credential_harvester 55% 1x OSINT 368 2 ssh:bruteforce — 2026-04-14 04:30 evidence →
101.126.67.70 scanner 53% 1x OSINT 113 2 ssh:bruteforce — 2026-04-30 03:07 evidence →
101.126.11.137 scanner 52% 1x OSINT 67 2 ssh:bruteforce — 2026-04-12 21:29 evidence →
45.61.187.30 credential_harvester 51% 880 2 ssh:bruteforce — 2026-04-03 15:05 evidence →
103.49.238.236 credential_harvester 51% 737 2 ssh:bruteforce — 2026-03-24 23:38 evidence →
194.107.115.2 credential_harvester 51% 695 2 ssh:bruteforce — 2026-04-14 23:47 evidence →
45.165.14.197 credential_harvester 50% 553 2 ssh:bruteforce — 2026-04-20 23:00 evidence →
205.185.125.150 credential_harvester 50% 392 2 ssh:bruteforce — 2026-03-22 22:32 evidence →
58.233.189.185 credential_harvester 50% 364 2 ssh:bruteforce — 2026-03-22 23:33 evidence →
76.164.199.207 credential_harvester 50% 315 2 ssh:bruteforce — 2026-03-27 07:24 evidence →
77.221.156.32 credential_harvester 49% DROP 190 2 ssh:bruteforce — 2026-03-22 18:05 evidence →
101.36.117.42 credential_harvester 48% 154 2 ssh:bruteforce — 2026-03-23 02:59 evidence →
91.217.139.150 credential_harvester 48% 123 2 ssh:bruteforce — 2026-03-22 23:15 evidence →
180.76.170.111 scanner 46% 40 2 ssh:bruteforce — 2026-04-11 05:41 evidence →
120.48.123.76 scanner 39% 1x OSINT 79 2 ssh:bruteforce — 2026-05-01 15:10 evidence →
2.57.122.199 opportunistic_bruter 34% DROP 50 2 ssh:bruteforce — 2026-04-21 04:02 evidence →
8.134.239.76 scanner 32% 1x OSINT 26 2 ssh:bruteforce — 2026-05-06 13:18 evidence →
175.0.66.52 scanner 24% 16 2 ssh:bruteforce — 2026-03-23 03:24 evidence →
18.116.101.220 scanner 10% 1x OSINT 337 3 http:scanssh:bruteforce scan.visionheight.com 2026-05-11 18:47 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds