IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
53 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
53 IPs
Below average
Total Events
10144
Below average by volume
Started / Ended
2026-02-24 09:40 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1105
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
14.22.82.116 credential_harvester 76% 1x OSINT 420 3 ssh:bruteforce — 2026-05-08 23:29 evidence →
39.123.249.114 credential_harvester 71% 1x OSINT 1397 3 ssh:bruteforce — 2026-05-04 10:47 evidence →
200.44.190.194 credential_harvester 71% 1x OSINT 929 3 ssh:bruteforce 200-44-190-194.bol-00.rai.cantv.net 2026-05-02 19:12 evidence →
193.32.162.151 credential_harvester 71% DROP2x OSINT 12349 3 ssh:bruteforce — 2026-05-08 21:54 evidence →
45.120.216.232 credential_harvester 71% 1x OSINT 652 3 ssh:bruteforce — 2026-05-04 22:26 evidence →
46.101.74.113 credential_harvester 63% 175 3 ssh:bruteforce — 2026-04-27 05:45 evidence →
172.236.228.39 web_probe 63% 52 3 http:scanssh:bruteforce — 2026-05-12 00:33 evidence →
197.248.207.139 credential_harvester 59% 1x OSINT 1509 2 ssh:bruteforce — 2026-05-07 08:08 evidence →
152.32.252.65 credential_harvester 58% 1x OSINT 756 2 ssh:bruteforce — 2026-05-06 15:51 evidence →
58.69.56.44 credential_harvester 57% 1x OSINT 1701 2 ssh:bruteforce — 2026-05-06 03:02 evidence →
172.234.217.129 web_probe 56% 41 3 http:scanssh:bruteforce 172-234-217-129.ip.linodeusercontent.com 2026-05-08 20:53 evidence →
66.228.53.78 web_probe 56% 48 3 http:scanssh:bruteforce — 2026-05-08 16:01 evidence →
220.247.224.226 credential_harvester 56% 1x OSINT 752 2 ssh:bruteforce — 2026-05-02 09:45 evidence →
155.4.244.169 credential_harvester 55% 1x OSINT 533 2 ssh:bruteforce h-155-4-244-169.NA.cust.bahnhof.se 2026-04-11 23:26 evidence →
172.173.117.246 credential_harvester 55% 1x OSINT 370 2 ssh:bruteforce — 2026-04-04 15:08 evidence →
103.20.122.54 credential_harvester 54% 1x OSINT 236 2 ssh:bruteforce — 2026-05-03 20:22 evidence →
187.174.238.116 credential_harvester 53% 1x OSINT 195 2 ssh:bruteforce customer-187-174-238-116.uninet-ide.com.mx 2026-04-18 02:42 evidence →
113.31.103.129 scanner 53% 1x OSINT 172 2 ssh:bruteforce — 2026-05-04 18:47 evidence →
180.76.245.60 scanner 53% 1x OSINT 150 2 ssh:bruteforce — 2026-04-14 19:34 evidence →
104.244.74.84 credential_harvester 52% 1065 2 ssh:bruteforce — 2026-04-13 21:00 evidence →
45.79.181.94 web_probe 51% 42 3 http:scanssh:bruteforce — 2026-05-06 03:55 evidence →
217.154.35.203 credential_harvester 51% 758 2 ssh:bruteforce ip217.154.35-203.pbiaas.com 2026-04-14 12:05 evidence →
106.13.48.156 scanner 51% 1x OSINT 42 2 ssh:bruteforce — 2026-04-23 20:08 evidence →
116.193.191.104 credential_harvester 51% 598 2 ssh:bruteforce ip116-193-191-104.cloudhost.web.id 2026-04-16 12:20 evidence →
103.155.57.54 credential_harvester 50% 534 2 ssh:bruteforce — 2026-04-01 03:19 evidence →
155.4.244.107 credential_harvester 50% 464 2 ssh:bruteforce — 2026-04-16 21:46 evidence →
103.183.74.187 credential_harvester 50% 379 2 ssh:bruteforce — 2026-04-13 10:59 evidence →
202.165.15.88 credential_harvester 49% 1x OSINT 66 2 ssh:bruteforce — 2026-03-27 18:14 evidence →
23.91.96.70 credential_harvester 49% 240 2 ssh:bruteforce — 2026-03-27 03:02 evidence →
45.121.147.48 credential_harvester 49% 215 2 ssh:bruteforce briskgriffin.info 2026-04-05 20:17 evidence →
187.85.187.100 credential_harvester 48% 160 2 ssh:bruteforce — 2026-04-02 22:50 evidence →
14.103.118.79 scanner 47% 70 2 ssh:bruteforce — 2026-04-18 18:20 evidence →
101.47.141.128 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-03-27 19:29 evidence →
101.126.69.201 scanner 46% 50 2 ssh:bruteforce — 2026-03-30 20:05 evidence →
43.134.0.196 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-26 21:05 evidence →
212.227.49.201 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-27 06:35 evidence →
45.93.30.244 scanner 46% 45 2 ssh:bruteforce — 2026-03-27 20:36 evidence →
181.50.102.36 credential_harvester 46% 43 2 ssh:bruteforce — 2026-03-26 21:32 evidence →
88.205.172.170 scanner 46% 1x OSINT 8 3 ssh:bruteforce — 2026-05-07 16:35 evidence →
23.97.62.152 reconnaissance 41% 707 2 ssh:bruteforce — 2026-03-27 08:29 evidence →
207.46.224.91 reconnaissance 39% 271 2 ssh:bruteforce — 2026-03-27 15:07 evidence →
5.189.129.10 reconnaissance 35% 26 2 ssh:bruteforce — 2026-03-27 01:18 evidence →
2.57.121.17 opportunistic_bruter 34% DROP 45 2 ssh:bruteforce — 2026-04-13 22:02 evidence →
64.62.197.47 scanner 33% 13 2 http:scanssh:bruteforce — 2026-03-27 04:55 evidence →
195.178.110.155 web_probe 30% DROP1x OSINT 15 2 http:scan — 2026-04-02 07:09 evidence →
45.156.128.128 web_probe 28% 1x OSINT 4 2 http:scan — 2026-04-01 04:03 evidence →
198.235.24.232 scanner 26% 1x OSINT 6 2 ssh:bruteforce — 2026-03-27 03:42 evidence →
80.102.218.207 credential_harvester 25% 27 2 ssh:bruteforce — 2026-03-27 11:07 evidence →
195.178.110.31 web_probe 24% DROP 6 2 http:scan — 2026-04-01 22:19 evidence →
195.178.110.68 web_probe 24% DROP 4 2 http:scan — 2026-03-27 00:13 evidence →
134.199.158.149 scanner 22% 8 2 ssh:bruteforce — 2026-04-01 00:25 evidence →
50.118.250.178 scanner 21% 4 2 ssh:bruteforce — 2026-03-27 17:34 evidence →
184.105.247.254 web_probe 10% 1x OSINT 16 2 http:scanssh:bruteforce scan-13o.shadowserver.org 2026-04-24 05:04 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds