IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
54 IPs
Below average
Total Events
5475
Below average by volume
Started / Ended
2026-02-22 23:06 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
161.49.89.39 credential_harvester 80% 1x OSINT 1361 3 ssh:bruteforce — 2026-05-09 18:04 evidence →
116.34.14.135 interactive_operator 79% 1x OSINT 306 3 ssh:bruteforce — 2026-05-11 10:40 evidence →
125.21.59.218 credential_harvester 77% 1x OSINT 1347 3 ssh:bruteforce — 2026-05-07 22:05 evidence →
43.159.177.40 credential_harvester 71% 1x OSINT 1265 3 ssh:bruteforce — 2026-04-25 00:51 evidence →
41.216.177.55 credential_harvester 70% 1x OSINT 395 3 ssh:bruteforce — 2026-04-27 06:08 evidence →
45.169.128.70 credential_harvester 69% 1x OSINT 243 3 ssh:bruteforce — 2026-04-30 07:49 evidence →
182.93.7.194 credential_harvester 67% 3879 3 ssh:bruteforce n18293z7l194.static.ctmip.net 2026-04-26 02:14 evidence →
2.57.122.197 opportunistic_bruter 63% DROP1x OSINT 75 3 ssh:bruteforce — 2026-05-09 13:03 evidence →
103.176.20.115 credential_harvester 61% 1x OSINT 444 2 ssh:bruteforce — 2026-05-07 23:56 evidence →
66.228.53.46 web_probe 58% 36 3 http:scanssh:bruteforce — 2026-05-09 09:51 evidence →
103.154.77.48 credential_harvester 58% 1x OSINT 1250 2 ssh:bruteforce 48.subs77.t2net.id 2026-05-05 21:58 evidence →
36.138.202.60 scanner 57% 1x OSINT 168 2 ssh:bruteforce — 2026-05-07 03:52 evidence →
61.220.235.10 credential_harvester 56% 1x OSINT 1135 2 ssh:bruteforce 61-220-235-10.hinet-ip.hinet.net 2026-04-20 08:50 evidence →
34.0.13.61 credential_harvester 56% 1x OSINT 908 2 ssh:bruteforce — 2026-04-14 07:37 evidence →
205.210.31.89 scanner 55% 9 3 http:scanssh:bruteforce — 2026-05-09 02:17 evidence →
104.218.166.62 credential_harvester 53% 1x OSINT 113 2 ssh:bruteforce — 2026-03-24 02:04 evidence →
103.13.207.34 credential_harvester 52% 1082 2 ssh:bruteforce — 2026-04-21 02:36 evidence →
193.123.245.198 credential_harvester 52% 1013 2 ssh:bruteforce — 2026-04-27 04:12 evidence →
14.103.123.75 scanner 51% 1x OSINT 46 2 ssh:bruteforce — 2026-04-24 23:43 evidence →
20.26.135.100 credential_harvester 51% 713 2 ssh:bruteforce — 2026-04-04 15:20 evidence →
203.145.34.78 credential_harvester 51% 667 2 ssh:bruteforce — 2026-04-07 02:28 evidence →
158.174.210.161 credential_harvester 50% 518 2 ssh:bruteforce h-158-174-210-161.NA.cust.bahnhof.se 2026-04-16 18:48 evidence →
118.139.164.171 credential_harvester 50% 500 2 ssh:bruteforce 171.164.139.118.host.secureserver.net 2026-04-08 23:32 evidence →
45.33.109.18 scanner 50% 1x OSINT 23 3 ssh:bruteforce — 2026-05-08 12:33 evidence →
220.247.223.56 credential_harvester 50% 384 2 ssh:bruteforce 56.sta.idc-2.slt.lk 2026-03-23 21:19 evidence →
185.242.3.105 reconnaissance 50% DROP 335 2 ssh:bruteforce — 2026-03-26 07:26 evidence →
34.69.0.72 credential_harvester 49% 288 2 ssh:bruteforce 72.0.69.34.bc.googleusercontent.com 2026-03-26 09:20 evidence →
212.11.64.229 credential_harvester 49% 254 2 ssh:bruteforce — 2026-03-24 03:38 evidence →
103.63.25.171 credential_harvester 49% 243 2 ssh:bruteforce — 2026-03-26 14:02 evidence →
123.58.219.234 credential_harvester 49% 197 2 ssh:bruteforce — 2026-03-24 06:55 evidence →
87.106.35.227 credential_harvester 48% 161 2 ssh:bruteforce — 2026-04-14 12:39 evidence →
122.118.208.71 credential_harvester 48% 159 2 ssh:bruteforce — 2026-03-24 02:22 evidence →
137.184.203.236 credential_harvester 48% 106 2 ssh:bruteforce — 2026-03-23 20:54 evidence →
14.103.120.129 scanner 46% 52 2 ssh:bruteforce — 2026-04-13 15:13 evidence →
211.200.98.61 proxy_abuser 45% 1x OSINT 12 2 ssh:bruteforce — 2026-03-23 21:52 evidence →
45.79.207.71 scanner 44% 21 3 ssh:bruteforce — 2026-05-08 02:33 evidence →
119.148.49.82 scanner 44% 60 3 ssh:bruteforce — 2026-05-07 03:34 evidence →
193.32.162.82 credential_harvester 43% DROP1x OSINT 134 2 ssh:bruteforce — 2026-04-18 08:36 evidence →
14.103.114.231 scanner 42% 1x OSINT 64 2 ssh:bruteforce — 2026-03-28 03:37 evidence →
14.103.114.89 credential_harvester 42% 1x OSINT 63 2 ssh:bruteforce — 2026-04-21 05:13 evidence →
43.130.14.245 web_probe 38% 3 3 http:scan — 2026-05-01 18:28 evidence →
180.76.172.156 scanner 34% 2x OSINT 37 2 ssh:bruteforce — 2026-05-04 19:11 evidence →
198.235.24.69 scanner 34% 15 2 http:scanssh:bruteforce — 2026-05-03 06:13 evidence →
165.154.11.52 scanner 33% 14 2 http:scanmysql:bruteforcessh:bruteforce — 2026-04-08 16:16 evidence →
180.76.184.79 scanner 31% 1x OSINT 41 2 ssh:bruteforce — 2026-04-29 12:00 evidence →
198.235.24.43 scanner 25% 14 2 ssh:bruteforce — 2026-05-05 23:44 evidence →
36.134.151.126 scanner 24% 15 2 ssh:bruteforce — 2026-03-26 00:07 evidence →
43.130.72.177 web_probe 24% 6 2 http:scan — 2026-04-28 16:01 evidence →
14.103.192.217 scanner 24% 13 2 ssh:bruteforce — 2026-03-23 11:41 evidence →
183.220.237.230 scanner 24% 13 2 ssh:bruteforce — 2026-04-03 13:27 evidence →
183.96.173.196 web_probe 24% 5 2 http:scan — 2026-04-21 08:40 evidence →
170.106.82.209 web_probe 24% 4 2 http:scan — 2026-04-11 14:09 evidence →
115.190.11.142 scanner 23% 8 2 ssh:bruteforce — 2026-03-24 03:19 evidence →
45.79.172.21 web_probe 10% 27 3 http:scanssh:bruteforce riga.scan.bufferover.run 2026-05-08 11:02 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds