IntrusionLabs IntrusionLabs
← Back to feed

Multi-Agent Scan

SCAN Active medium
Why this campaign was detected
43 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close succession indicates shared reconnaissance tooling or a coordinated scan list.
Primary ASN
—
Subnet
—
Country
—
Cloud Provider
—
Member Count
43 IPs
Below average
Total Events
10040
Below average by volume
Started / Ended
2026-02-26 13:01 — ongoing
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078 T1190
Credential Access
T1110 T1110.001
Discovery
T1016 T1046 T1082
Command and Control
T1090 T1105 T1572
Exfiltration
T1048
Member Actors
IP Address Behavior Confidence Flags Events Agents Attack Types Hostname Last Seen
80.94.92.182 credential_harvester 78% DROP2x OSINT 9488 3 ssh:bruteforce — 2026-05-13 11:23 evidence →
2.57.122.191 opportunistic_bruter 67% DROP1x OSINT 145 3 ssh:bruteforce — 2026-05-13 01:03 evidence →
172.236.228.208 web_probe 62% 1x OSINT 63 3 http:scanssh:bruteforce 172-236-228-208.ip.linodeusercontent.com 2026-05-10 04:47 evidence →
172.105.128.12 web_probe 60% 1x OSINT 60 3 http:scanssh:bruteforce — 2026-05-09 04:33 evidence →
14.103.120.138 scanner 59% 1x OSINT 191 2 ssh:bruteforce — 2026-05-09 12:33 evidence →
59.36.78.66 credential_harvester 58% 1x OSINT 107 2 ssh:bruteforce — 2026-05-09 12:29 evidence →
172.235.40.131 web_probe 57% 39 3 http:scanssh:bruteforce — 2026-05-10 14:35 evidence →
168.167.72.132 credential_harvester 56% 1x OSINT 936 2 ssh:bruteforce — 2026-05-01 11:48 evidence →
202.165.15.132 credential_harvester 56% 1x OSINT 702 2 ssh:bruteforce — 2026-04-19 20:31 evidence →
103.237.144.204 credential_harvester 55% 1x OSINT 533 2 ssh:bruteforce — 2026-05-04 10:20 evidence →
190.108.60.10 credential_harvester 54% 1x OSINT 201 2 ssh:bruteforce — 2026-03-28 11:22 evidence →
103.200.25.79 credential_harvester 53% 1x OSINT 114 2 ssh:bruteforce — 2026-03-30 04:23 evidence →
170.254.229.191 opportunistic_bruter 52% 1x OSINT 92 2 ssh:bruteforce — 2026-03-28 06:26 evidence →
14.224.227.189 malware_dropper 52% 1x OSINT 91 2 ssh:bruteforce — 2026-03-28 12:03 evidence →
190.60.242.28 credential_harvester 52% 1x OSINT 77 2 ssh:bruteforce — 2026-03-28 07:47 evidence →
106.12.138.190 scanner 51% 1x OSINT 57 2 ssh:bruteforce — 2026-05-01 09:49 evidence →
128.14.237.154 credential_harvester 51% 1x OSINT 56 2 ssh:bruteforce — 2026-05-06 02:12 evidence →
185.181.10.136 credential_harvester 51% 712 2 ssh:bruteforce — 2026-04-22 16:08 evidence →
123.48.142.249 credential_harvester 51% 698 2 ssh:bruteforce — 2026-04-22 09:55 evidence →
152.32.174.67 credential_harvester 51% 562 2 ssh:bruteforce — 2026-04-12 12:05 evidence →
178.128.92.222 credential_harvester 50% 420 2 ssh:bruteforce — 2026-04-01 07:22 evidence →
103.62.152.202 credential_harvester 50% 359 2 ssh:bruteforce 202.152.62.103.in-addr.arpa.cable21.net 2026-03-31 04:35 evidence →
45.195.221.26 credential_harvester 49% 271 2 ssh:bruteforce — 2026-04-20 03:49 evidence →
103.82.27.19 reconnaissance 49% 2651 2 ssh:bruteforce — 2026-03-29 02:18 evidence →
60.190.239.92 scanner 49% 213 2 ssh:bruteforce — 2026-04-02 05:23 evidence →
186.56.11.2 opportunistic_bruter 47% 69 2 ssh:bruteforce — 2026-03-28 13:22 evidence →
103.82.37.117 malware_dropper 47% 69 2 ssh:bruteforce smtp.pagymogo.ink 2026-04-02 00:09 evidence →
36.134.138.153 scanner 46% 52 2 ssh:bruteforce — 2026-04-02 03:11 evidence →
163.43.142.110 malware_dropper 46% 46 2 ssh:bruteforce — 2026-03-29 02:56 evidence →
109.73.207.89 opportunistic_bruter 46% 46 2 ssh:bruteforce — 2026-03-29 02:16 evidence →
101.47.161.85 credential_harvester 46% 43 2 ssh:bruteforce — 2026-03-28 10:39 evidence →
171.243.149.203 credential_harvester 46% 317 2 ssh:bruteforce — 2026-03-28 20:28 evidence →
5.161.233.230 reconnaissance 40% 513 2 ssh:bruteforce — 2026-03-28 11:50 evidence →
203.83.231.93 scanner 40% 1x OSINT 20 2 ssh:bruteforce — 2026-03-28 16:22 evidence →
114.217.149.27 scanner 36% 1x OSINT 14 2 ssh:bruteforce — 2026-05-10 14:53 evidence →
8.134.239.76 scanner 36% 28 2 ssh:bruteforce — 2026-05-13 02:29 evidence →
59.37.58.205 scanner 35% 17 2 ssh:bruteforce — 2026-03-28 11:42 evidence →
2.57.121.86 opportunistic_bruter 33% DROP 30 2 ssh:bruteforce — 2026-04-12 19:04 evidence →
134.0.106.249 scanner 24% 14 2 ssh:bruteforce — 2026-03-29 04:53 evidence →
121.40.84.227 scanner 23% 18 2 ssh:bruteforce — 2026-04-27 01:43 evidence →
103.29.70.204 scanner 22% 8 2 ssh:bruteforce — 2026-03-28 14:15 evidence →
172.104.11.34 web_probe 10% 1x OSINT 23 3 http:scanssh:bruteforce edinburgh.scan.bufferover.run 2026-05-08 09:01 evidence →
64.62.197.197 scanner 10% 15 3 http:scanssh:bruteforce scan-50a.shadowserver.org 2026-05-10 11:38 evidence →
VPN Known VPN or proxy provider
DROP ASN on Spamhaus DROP list
Nx OSINT Corroborated by N external threat feeds