IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
38 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
38 IPs
Below average
Total Events
5037
Below average by volume
Started / Ended
2026-03-01 01:52 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
172.191.157.64 credential_harvester 80% 1x OSINT 1242 3 ssh:bruteforce — 2026-05-09 19:45 evidence →
150.5.169.176 credential_harvester 77% 1x OSINT 818 3 ssh:bruteforce — 2026-05-08 07:13 evidence →
45.120.216.232 credential_harvester 71% 1x OSINT 652 3 ssh:bruteforce — 2026-05-04 22:26 evidence →
172.234.217.129 web_probe 63% 42 3 http:scanssh:bruteforce 172-234-217-129.ip.linodeusercontent.com 2026-05-11 16:57 evidence →
172.236.228.39 web_probe 62% 41 3 http:scanssh:bruteforce — 2026-05-11 12:33 evidence →
2.57.122.189 opportunistic_bruter 62% DROP1x OSINT 100 3 ssh:bruteforce — 2026-05-09 01:02 evidence →
103.176.20.115 credential_harvester 61% 1x OSINT 444 2 ssh:bruteforce — 2026-05-07 23:56 evidence →
49.247.36.49 credential_harvester 56% 1x OSINT 897 2 ssh:bruteforce — 2026-04-26 08:32 evidence →
47.247.99.155 credential_harvester 55% 1x OSINT 590 2 ssh:bruteforce — 2026-04-27 04:39 evidence →
172.173.117.246 credential_harvester 55% 1x OSINT 370 2 ssh:bruteforce — 2026-04-04 15:08 evidence →
103.20.122.54 credential_harvester 54% 1x OSINT 236 2 ssh:bruteforce — 2026-05-03 20:22 evidence →
187.174.238.116 credential_harvester 53% 1x OSINT 195 2 ssh:bruteforce customer-187-174-238-116.uninet-ide.com.mx 2026-04-18 02:42 evidence →
113.31.103.129 scanner 53% 1x OSINT 172 2 ssh:bruteforce — 2026-05-04 18:47 evidence →
217.154.35.203 credential_harvester 51% 758 2 ssh:bruteforce ip217.154.35-203.pbiaas.com 2026-04-14 12:05 evidence →
116.193.191.104 credential_harvester 51% 598 2 ssh:bruteforce ip116-193-191-104.cloudhost.web.id 2026-04-16 12:20 evidence →
103.155.57.54 credential_harvester 50% 534 2 ssh:bruteforce — 2026-04-01 03:19 evidence →
128.1.38.169 credential_harvester 50% 478 2 ssh:bruteforce — 2026-04-08 23:56 evidence →
103.76.120.225 credential_harvester 50% 448 2 ssh:bruteforce — 2026-04-22 22:30 evidence →
64.188.83.244 credential_harvester 50% 439 2 ssh:bruteforce bobrobet.net 2026-03-27 05:03 evidence →
103.183.74.187 credential_harvester 50% 379 2 ssh:bruteforce — 2026-04-13 10:59 evidence →
76.164.199.207 credential_harvester 50% 315 2 ssh:bruteforce — 2026-03-27 07:24 evidence →
118.193.34.157 credential_harvester 49% 293 2 ssh:bruteforce — 2026-03-27 04:44 evidence →
23.91.96.70 credential_harvester 49% 240 2 ssh:bruteforce — 2026-03-27 03:02 evidence →
101.52.130.122 credential_harvester 49% 205 2 ssh:bruteforce — 2026-05-02 10:04 evidence →
85.239.151.41 credential_harvester 48% 114 2 ssh:bruteforce — 2026-03-26 20:13 evidence →
88.205.172.170 scanner 47% 1x OSINT 8 3 ssh:bruteforce — 2026-05-07 16:35 evidence →
14.103.118.79 scanner 47% 70 2 ssh:bruteforce — 2026-04-18 18:20 evidence →
43.134.0.196 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-26 21:05 evidence →
212.227.49.201 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-27 06:35 evidence →
181.50.102.36 credential_harvester 46% 43 2 ssh:bruteforce — 2026-03-26 21:32 evidence →
14.103.114.231 scanner 42% 1x OSINT 64 2 ssh:bruteforce — 2026-03-28 03:37 evidence →
64.62.197.47 scanner 38% 1x OSINT 13 2 http:scanssh:bruteforce — 2026-03-27 04:55 evidence →
120.48.147.81 scanner 37% 25 2 ssh:bruteforce — 2026-05-11 04:16 evidence →
5.189.129.10 reconnaissance 35% 26 2 ssh:bruteforce — 2026-03-27 01:18 evidence →
43.166.237.57 web_probe 25% 6 2 http:scan — 2026-05-05 09:27 evidence →
195.178.110.31 web_probe 24% DROP 6 2 http:scan — 2026-04-01 22:19 evidence →
198.235.24.232 scanner 22% 6 2 ssh:bruteforce — 2026-03-27 03:42 evidence →
184.105.247.254 web_probe 10% 16 2 http:scanssh:bruteforce scan-13o.shadowserver.org 2026-04-24 05:04 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds