IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
54 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
54 IPs
Below average
Total Events
7812
Below average by volume
Started / Ended
2026-02-22 21:00 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
211.228.218.47 credential_harvester 74% 1x OSINT 171 3 ssh:bruteforce — 2026-05-08 02:23 evidence →
193.32.162.145 credential_harvester 73% DROP1x OSINT 9742 3 ssh:bruteforce — 2026-05-11 01:31 evidence →
39.123.249.114 credential_harvester 71% 1x OSINT 1397 3 ssh:bruteforce — 2026-05-04 10:47 evidence →
45.120.216.232 credential_harvester 71% 1x OSINT 652 3 ssh:bruteforce — 2026-05-04 22:26 evidence →
106.13.48.156 scanner 64% 1x OSINT 58 2 ssh:bruteforce — 2026-05-11 21:57 evidence →
46.101.74.113 credential_harvester 63% 175 3 ssh:bruteforce — 2026-04-27 05:45 evidence →
172.234.217.129 web_probe 63% 42 3 http:scanssh:bruteforce 172-234-217-129.ip.linodeusercontent.com 2026-05-11 16:57 evidence →
172.236.228.39 web_probe 62% 41 3 http:scanssh:bruteforce — 2026-05-11 12:33 evidence →
58.69.56.44 credential_harvester 58% 1x OSINT 1701 2 ssh:bruteforce — 2026-05-06 03:02 evidence →
66.228.53.78 web_probe 57% 48 3 http:scanssh:bruteforce — 2026-05-08 16:01 evidence →
45.78.204.246 credential_harvester 56% 1x OSINT 490 2 ssh:bruteforce — 2026-05-05 17:16 evidence →
81.192.46.45 credential_harvester 56% 1x OSINT 868 2 ssh:bruteforce adsl-45-46-192-81.adsl.iam.net.ma 2026-04-30 22:23 evidence →
45.119.212.99 credential_harvester 56% 1x OSINT 688 2 ssh:bruteforce — 2026-05-02 05:12 evidence →
155.4.244.107 credential_harvester 55% 1x OSINT 464 2 ssh:bruteforce — 2026-04-16 21:46 evidence →
172.173.117.246 credential_harvester 55% 1x OSINT 370 2 ssh:bruteforce — 2026-04-04 15:08 evidence →
103.20.122.54 credential_harvester 54% 1x OSINT 236 2 ssh:bruteforce — 2026-05-03 20:22 evidence →
187.174.238.116 credential_harvester 53% 1x OSINT 195 2 ssh:bruteforce customer-187-174-238-116.uninet-ide.com.mx 2026-04-18 02:42 evidence →
113.31.103.129 scanner 53% 1x OSINT 172 2 ssh:bruteforce — 2026-05-04 18:47 evidence →
180.76.245.60 scanner 53% 1x OSINT 150 2 ssh:bruteforce — 2026-04-14 19:34 evidence →
45.79.181.94 web_probe 53% 42 3 http:scanssh:bruteforce — 2026-05-06 03:55 evidence →
104.244.74.84 credential_harvester 52% 1065 2 ssh:bruteforce — 2026-04-13 21:00 evidence →
217.154.35.203 credential_harvester 51% 758 2 ssh:bruteforce ip217.154.35-203.pbiaas.com 2026-04-14 12:05 evidence →
116.193.191.104 credential_harvester 51% 598 2 ssh:bruteforce ip116-193-191-104.cloudhost.web.id 2026-04-16 12:20 evidence →
103.155.57.54 credential_harvester 50% 534 2 ssh:bruteforce — 2026-04-01 03:19 evidence →
128.1.38.169 credential_harvester 50% 478 2 ssh:bruteforce — 2026-04-08 23:56 evidence →
103.183.74.187 credential_harvester 50% 379 2 ssh:bruteforce — 2026-04-13 10:59 evidence →
118.193.34.157 credential_harvester 49% 293 2 ssh:bruteforce — 2026-03-27 04:44 evidence →
23.91.96.70 credential_harvester 49% 240 2 ssh:bruteforce — 2026-03-27 03:02 evidence →
212.11.64.154 credential_harvester 48% 123 2 ssh:bruteforce — 2026-03-26 19:10 evidence →
85.239.151.41 credential_harvester 48% 114 2 ssh:bruteforce — 2026-03-26 20:13 evidence →
101.47.163.102 credential_harvester 48% 111 2 ssh:bruteforce — 2026-03-26 15:25 evidence →
88.205.172.170 scanner 47% 1x OSINT 8 3 ssh:bruteforce — 2026-05-07 16:35 evidence →
14.103.118.79 scanner 47% 70 2 ssh:bruteforce — 2026-04-18 18:20 evidence →
101.126.69.201 scanner 46% 50 2 ssh:bruteforce — 2026-03-30 20:05 evidence →
212.227.49.201 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-27 06:35 evidence →
43.134.0.196 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-26 21:05 evidence →
181.50.102.36 credential_harvester 46% 43 2 ssh:bruteforce — 2026-03-26 21:32 evidence →
86.102.131.54 scanner 45% 29 2 ssh:bruteforce — 2026-04-01 16:17 evidence →
23.97.62.152 reconnaissance 41% 707 2 ssh:bruteforce — 2026-03-27 08:29 evidence →
207.46.224.91 reconnaissance 39% 271 2 ssh:bruteforce — 2026-03-27 15:07 evidence →
43.155.162.41 web_probe 39% 6 3 http:scan — 2026-04-30 22:12 evidence →
120.48.147.81 scanner 37% 25 2 ssh:bruteforce — 2026-05-11 04:16 evidence →
5.189.129.10 reconnaissance 35% 26 2 ssh:bruteforce — 2026-03-27 01:18 evidence →
118.193.39.117 scanner 34% 26 2 http:scanssh:bruteforce — 2026-03-26 15:35 evidence →
2.57.121.17 opportunistic_bruter 34% DROP 45 2 ssh:bruteforce — 2026-04-13 22:02 evidence →
198.235.24.200 scanner 32% 5 2 http:scanssh:bruteforce — 2026-03-27 10:44 evidence →
195.178.110.155 web_probe 30% DROP1x OSINT 15 2 http:scan — 2026-04-02 07:09 evidence →
14.103.105.36 credential_probe 27% 1x OSINT 21 2 ssh:bruteforce — 2026-03-26 16:06 evidence →
80.102.218.207 credential_harvester 25% 27 2 ssh:bruteforce — 2026-03-27 11:07 evidence →
195.178.110.31 web_probe 24% DROP 6 2 http:scan — 2026-04-01 22:19 evidence →
195.178.110.68 web_probe 24% DROP 4 2 http:scan — 2026-03-27 00:13 evidence →
1.94.30.46 credential_probe 22% 21 2 ssh:bruteforce — 2026-03-26 15:25 evidence →
198.235.24.232 scanner 22% 6 2 ssh:bruteforce — 2026-03-27 03:42 evidence →
184.105.247.254 web_probe 10% 16 2 http:scanssh:bruteforce scan-13o.shadowserver.org 2026-04-24 05:04 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds