IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
2795
Below average by volume
Started / Ended
2026-02-22 17:04 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
187.110.238.50 credential_harvester 71% 1x OSINT 709 3 ssh:bruteforce 187.110.238.50.mobtelecom.com.br 2026-05-03 10:21 evidence →
64.62.156.122 scanner 63% 1x OSINT 33 3 http:scanssh:bruteforce — 2026-05-09 11:27 evidence →
172.236.127.133 web_probe 63% 48 3 http:scanssh:bruteforce — 2026-05-11 10:58 evidence →
172.236.119.165 web_probe 63% 40 3 http:scanssh:bruteforce — 2026-05-11 14:37 evidence →
160.251.197.41 credential_harvester 62% 1x OSINT 361 2 ssh:bruteforce — 2026-05-08 20:19 evidence →
180.168.24.186 scanner 57% 1x OSINT 264 2 ssh:bruteforce — 2026-05-06 14:38 evidence →
45.10.175.77 opportunistic_bruter 57% DROP 50 3 ssh:bruteforce — 2026-05-09 08:07 evidence →
2.57.122.196 opportunistic_bruter 55% DROP1x OSINT 90 3 ssh:bruteforce — 2026-05-02 01:03 evidence →
103.187.147.214 credential_harvester 54% 1x OSINT 338 2 ssh:bruteforce — 2026-03-25 15:36 evidence →
190.119.198.81 credential_harvester 54% 1x OSINT 304 2 ssh:bruteforce — 2026-03-26 03:02 evidence →
175.12.108.55 scanner 53% 1x OSINT 119 2 ssh:bruteforce — 2026-04-27 05:41 evidence →
45.79.181.94 web_probe 53% 42 3 http:scanssh:bruteforce — 2026-05-06 03:55 evidence →
150.5.129.10 credential_harvester 51% 832 2 ssh:bruteforce — 2026-04-25 02:46 evidence →
103.180.241.18 credential_harvester 49% 240 2 ssh:bruteforce — 2026-03-25 00:55 evidence →
82.22.21.41 credential_harvester 49% 221 2 ssh:bruteforce — 2026-03-25 07:37 evidence →
144.31.234.168 credential_harvester 49% 211 2 ssh:bruteforce — 2026-03-25 08:54 evidence →
110.166.66.102 credential_harvester 48% 145 2 ssh:bruteforce — 2026-04-08 01:19 evidence →
39.115.183.206 credential_harvester 48% 144 2 ssh:bruteforce — 2026-04-22 13:50 evidence →
14.103.131.112 scanner 48% 123 2 ssh:bruteforce — 2026-04-11 05:40 evidence →
80.94.95.115 credential_harvester 47% DROP 529 2 ssh:bruteforce — 2026-03-25 18:56 evidence →
202.165.15.88 credential_harvester 44% 66 2 ssh:bruteforce — 2026-03-27 18:14 evidence →
43.157.172.39 web_probe 39% 5 3 http:scan — 2026-04-30 23:48 evidence →
23.97.62.120 reconnaissance 37% 64 2 ssh:bruteforce — 2026-03-25 12:08 evidence →
120.48.147.81 scanner 37% 25 2 ssh:bruteforce — 2026-05-11 04:16 evidence →
14.29.238.151 credential_harvester 35% 84 2 ssh:bruteforce — 2026-03-26 09:43 evidence →
216.180.246.47 scanner 32% 7 2 http:scanssh:bruteforce — 2026-03-25 04:19 evidence →
177.234.209.102 credential_harvester 26% 33 2 ssh:bruteforce — 2026-03-26 02:34 evidence →
89.42.231.182 scanner 25% 42 2 ssh:bruteforce — 2026-03-25 09:44 evidence →
106.74.5.114 scanner 25% 17 2 ssh:bruteforce — 2026-03-24 20:41 evidence →
101.32.15.141 web_probe 24% 4 2 http:scan — 2026-04-22 02:00 evidence →
147.185.132.135 scanner 23% 18 2 ssh:bruteforce — 2026-04-28 22:51 evidence →
159.89.94.22 scanner 22% 8 2 ssh:bruteforce — 2026-03-25 11:47 evidence →
64.62.197.152 scanner 10% 14 2 ssh:bruteforce scan-41a.shadowserver.org 2026-05-11 04:09 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds