IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
50 IPs
Below average
Total Events
10981
Below average by volume
Started / Ended
2026-02-26 05:33 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
197.199.224.52 credential_harvester 83% 1x OSINT 1154 3 ssh:bruteforce — 2026-05-11 05:39 evidence →
161.49.89.39 credential_harvester 80% 1x OSINT 1361 3 ssh:bruteforce — 2026-05-09 18:04 evidence →
199.231.163.19 credential_harvester 71% 1x OSINT 885 3 ssh:bruteforce secure7.grupoemar.mx 2026-05-03 14:20 evidence →
68.183.236.1 credential_harvester 70% 1x OSINT 558 3 ssh:bruteforce — 2026-05-04 12:39 evidence →
103.134.154.55 credential_harvester 70% 1x OSINT 376 3 ssh:bruteforce ip55.154.134.103.in-addr.arpa.unknwn.cloudhost.asia 2026-04-25 17:14 evidence →
2.57.122.191 opportunistic_bruter 68% DROP1x OSINT 135 3 ssh:bruteforce — 2026-05-11 16:02 evidence →
43.245.97.82 credential_harvester 66% 1x OSINT 334 2 ssh:bruteforce v097082.serveradd.com 2026-05-11 04:41 evidence →
198.98.55.71 credential_harvester 63% 1x OSINT 1136 2 ssh:bruteforce — 2026-05-08 14:37 evidence →
2.57.122.194 opportunistic_bruter 62% DROP1x OSINT 165 3 ssh:bruteforce — 2026-05-08 04:03 evidence →
14.103.21.179 scanner 59% 1x OSINT 389 2 ssh:bruteforce — 2026-05-07 06:55 evidence →
36.138.202.60 scanner 57% 1x OSINT 168 2 ssh:bruteforce — 2026-05-07 03:52 evidence →
171.25.158.74 credential_harvester 56% 1x OSINT 869 2 ssh:bruteforce — 2026-05-03 06:57 evidence →
45.79.181.223 web_probe 56% 24 3 http:scanssh:bruteforce — 2026-05-08 11:27 evidence →
45.78.198.228 credential_harvester 55% 1x OSINT 482 2 ssh:bruteforce — 2026-04-29 10:16 evidence →
78.44.192.210 credential_harvester 55% 1x OSINT 421 2 ssh:bruteforce — 2026-03-28 17:00 evidence →
201.71.192.108 credential_harvester 54% 1x OSINT 350 2 ssh:bruteforce — 2026-03-23 04:41 evidence →
14.103.115.25 scanner 54% 1x OSINT 273 2 ssh:bruteforce — 2026-05-02 16:23 evidence →
101.126.67.70 scanner 53% 1x OSINT 113 2 ssh:bruteforce — 2026-04-30 03:07 evidence →
14.103.105.254 scanner 52% 1x OSINT 92 2 ssh:bruteforce — 2026-04-17 10:12 evidence →
101.126.11.137 scanner 52% 1x OSINT 67 2 ssh:bruteforce — 2026-04-12 21:29 evidence →
187.212.40.215 credential_harvester 52% 1367 2 ssh:bruteforce — 2026-04-08 07:48 evidence →
51.75.194.10 credential_harvester 52% 1073 2 ssh:bruteforce — 2026-04-20 12:58 evidence →
103.175.225.238 credential_harvester 52% 1023 2 ssh:bruteforce — 2026-04-08 15:43 evidence →
203.145.34.82 credential_harvester 51% 954 2 ssh:bruteforce — 2026-04-23 18:26 evidence →
194.107.115.2 credential_harvester 51% 695 2 ssh:bruteforce — 2026-04-14 23:47 evidence →
14.103.117.141 scanner 51% 1x OSINT 41 2 ssh:bruteforce — 2026-04-27 13:56 evidence →
165.227.119.154 credential_harvester 51% 570 2 ssh:bruteforce — 2026-04-07 14:19 evidence →
118.193.33.128 credential_harvester 51% 566 2 ssh:bruteforce — 2026-04-29 12:28 evidence →
205.185.125.150 credential_harvester 50% 392 2 ssh:bruteforce — 2026-03-22 22:32 evidence →
58.233.189.185 credential_harvester 50% 364 2 ssh:bruteforce — 2026-03-22 23:33 evidence →
76.164.199.207 credential_harvester 50% 315 2 ssh:bruteforce — 2026-03-27 07:24 evidence →
64.62.197.92 scanner 49% 20 3 http:scanssh:bruteforce — 2026-04-28 06:26 evidence →
77.221.156.32 credential_harvester 49% DROP 190 2 ssh:bruteforce — 2026-03-22 18:05 evidence →
87.106.35.227 credential_harvester 48% 161 2 ssh:bruteforce — 2026-04-14 12:39 evidence →
91.217.139.150 credential_harvester 48% 123 2 ssh:bruteforce — 2026-03-22 23:15 evidence →
163.7.1.133 credential_harvester 47% 91 2 ssh:bruteforce — 2026-03-23 06:17 evidence →
180.76.170.111 scanner 46% 40 2 ssh:bruteforce — 2026-04-11 05:41 evidence →
92.118.39.92 credential_harvester 42% DROP 9533 2 ssh:bruteforce — 2026-04-13 17:35 evidence →
43.153.102.138 web_probe 39% 7 3 http:scan — 2026-05-04 23:09 evidence →
71.6.232.22 scanner 39% 20 3 ssh:bruteforce — 2026-04-27 08:45 evidence →
180.76.172.156 scanner 34% 2x OSINT 37 2 ssh:bruteforce — 2026-05-04 19:11 evidence →
2.57.122.199 opportunistic_bruter 34% DROP 50 2 ssh:bruteforce — 2026-04-21 04:02 evidence →
8.134.239.76 scanner 32% 1x OSINT 26 2 ssh:bruteforce — 2026-05-06 13:18 evidence →
62.192.226.83 credential_probe 27% 1x OSINT 21 2 ssh:bruteforce — 2026-03-23 05:24 evidence →
180.184.52.206 credential_probe 25% 118 2 ssh:bruteforce — 2026-03-30 06:07 evidence →
14.103.179.212 scanner 25% 17 2 ssh:bruteforce — 2026-03-23 07:26 evidence →
175.0.66.52 scanner 24% 16 2 ssh:bruteforce — 2026-03-23 03:24 evidence →
14.103.192.217 scanner 24% 13 2 ssh:bruteforce — 2026-03-23 11:41 evidence →
170.106.82.209 web_probe 24% 4 2 http:scan — 2026-04-11 14:09 evidence →
64.181.211.198 web_probe 24% 4 2 http:scan — 2026-03-22 19:35 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds