IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
33 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
33 IPs
Below average
Total Events
3410
Below average by volume
Started / Ended
2026-03-01 06:08 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
51.158.120.121 credential_harvester 80% 1x OSINT 2021 3 ssh:bruteforce 121-120-158-51.instances.scw.cloud 2026-05-09 23:50 evidence →
43.155.21.198 credential_harvester 72% 1x OSINT 728 3 ssh:bruteforce — 2026-05-06 08:47 evidence →
14.29.240.154 scanner 61% 1x OSINT 127 2 ssh:bruteforce — 2026-05-09 22:13 evidence →
197.248.207.139 credential_harvester 60% 1x OSINT 1509 2 ssh:bruteforce — 2026-05-07 08:08 evidence →
152.32.252.65 credential_harvester 58% 1x OSINT 756 2 ssh:bruteforce — 2026-05-06 15:51 evidence →
221.213.129.46 credential_harvester 57% 1x OSINT 283 2 ssh:bruteforce — 2026-05-07 03:42 evidence →
113.137.40.250 scanner 57% 1x OSINT 138 2 ssh:bruteforce — 2026-05-07 13:57 evidence →
45.61.187.220 credential_harvester 56% 1x OSINT 791 2 ssh:bruteforce node3.anycasthub.com 2026-05-05 11:11 evidence →
220.247.224.226 credential_harvester 56% 1x OSINT 752 2 ssh:bruteforce — 2026-05-02 09:45 evidence →
170.80.65.140 credential_harvester 56% 1x OSINT 737 2 ssh:bruteforce — 2026-04-29 02:42 evidence →
103.189.235.176 credential_harvester 55% 1x OSINT 585 2 ssh:bruteforce ip103-189-235-176.cloudhost.web.id 2026-04-29 05:42 evidence →
187.72.128.177 credential_harvester 51% 1x OSINT 48 2 ssh:bruteforce — 2026-03-28 03:15 evidence →
155.4.244.169 credential_harvester 50% 533 2 ssh:bruteforce h-155-4-244-169.NA.cust.bahnhof.se 2026-04-11 23:26 evidence →
45.175.37.29 credential_harvester 50% 457 2 ssh:bruteforce — 2026-04-16 17:24 evidence →
103.80.87.39 credential_harvester 49% 304 2 ssh:bruteforce — 2026-04-14 15:40 evidence →
116.193.190.100 credential_harvester 49% 281 2 ssh:bruteforce — 2026-04-07 10:01 evidence →
36.104.144.114 scanner 49% 186 2 ssh:bruteforce — 2026-04-05 13:36 evidence →
187.85.187.100 credential_harvester 48% 160 2 ssh:bruteforce — 2026-04-02 22:50 evidence →
115.190.87.35 scanner 48% 125 2 ssh:bruteforce — 2026-04-01 02:10 evidence →
103.49.238.35 credential_harvester 47% 98 2 ssh:bruteforce — 2026-03-27 21:43 evidence →
101.47.141.128 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-03-27 19:29 evidence →
107.173.160.152 credential_harvester 46% 48 2 ssh:bruteforce — 2026-03-28 02:42 evidence →
45.93.30.244 scanner 46% 45 2 ssh:bruteforce — 2026-03-27 20:36 evidence →
171.231.194.69 credential_harvester 45% 272 2 ssh:bruteforce — 2026-03-28 03:42 evidence →
202.165.15.88 credential_harvester 44% 66 2 ssh:bruteforce — 2026-03-27 18:14 evidence →
14.103.114.17 scanner 44% 1x OSINT 202 2 ssh:bruteforce — 2026-05-02 15:02 evidence →
14.103.114.231 scanner 42% 1x OSINT 64 2 ssh:bruteforce — 2026-03-28 03:37 evidence →
5.161.233.230 reconnaissance 40% 513 2 ssh:bruteforce — 2026-03-28 11:50 evidence →
115.191.45.206 scanner 35% 19 2 ssh:bruteforce — 2026-03-28 01:01 evidence →
45.156.128.128 web_probe 32% 2x OSINT 4 2 http:scan — 2026-04-01 04:03 evidence →
134.199.158.149 scanner 22% 8 2 ssh:bruteforce — 2026-04-01 00:25 evidence →
188.17.148.221 scanner 22% 6 2 ssh:bruteforce — 2026-04-11 02:02 evidence →
50.118.250.178 scanner 21% 4 2 ssh:bruteforce — 2026-03-27 17:34 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds